CVE-2008-4801: Heap-based buffer overflow in the Data Protection for SQL CAD service (aka dsmcat.exe) in the Client Accept...

Security readout for executives and security teams

This is a remote code execution issue in older IBM Tivoli Storage Manager backup components. A vulnerable client service can be crashed or potentially taken over if an attacker can send crafted data to its TCP listener. The business risk is highest where legacy TSM or TSM Express clients remain reachable on production or backup networks. Exposure is likely limited to organizations still running legacy IBM TSM Backup-Archive, Data Protection for SQL, or TSM Express clients in the affected 5.x ranges, especially where CAD or scheduler TCP services are reachable. Prioritize remediation where legacy TSM clients are still active and reachable. Backup systems often have privileged access and operational importance, so remote code execution in these services can create both compromise and resilience risk. Mitigation focus: Inventory TSM and TSM Express clients against the affected 5.x version ranges.; Review IBM advisory and APAR guidance for supported fixed or replacement versions.; Restrict CAD and scheduler TCP access to trusted backup infrastructure only..

Prepared

Jun 28, 2026, 18:33 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.