Vulnerability · Published Sep 8, 2026 · Assigned by ibm

CVE-2026-19651IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

High 7.4

In plain English

A high-severity authorization bypass via user-controlled key in Enterprise Build of Quarkus from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.3%top 72.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input.

Affected products (as reported)

Vendor	Product	Versions
IBM	Enterprise Build of Quarkus	3.27.1 – through 3.27.53.33.1 – through 3.33.3

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://www.ibm.com/support/pages/node/7286498 vendor-advisory, patch