CVE-2013-6719: delivery.php in the Passive Capture Application (PCA) web console in IBM Tealeaf CX 7.x, 8.x through 8.6, 8...

Security readout for executives and security teams

This issue affects the IBM Tealeaf CX Passive Capture Application web console. An authenticated remote user could abuse a connection-test parameter to run operating-system commands on the server. That can turn a compromised or misused console account into server control, especially where the console is reachable beyond a tightly controlled admin network. Exposure is most likely in legacy IBM Tealeaf CX deployments with the PCA web console enabled and accessible to authenticated users. Internet exposure is not stated in the sources. Organizations without Tealeaf CX, or with fixed 8.7 FP2 or 8.8 FP2 builds, are less likely exposed. Prioritize this where IBM Tealeaf CX remains in production, especially if the PCA web console is broadly reachable. The issue is old, authenticated, and product-specific, but command execution on a capture infrastructure component can have serious operational and data-security consequences. Mitigation focus: Identify any IBM Tealeaf CX and PCA web console deployments.; Upgrade affected 8.7 and 8.8 systems to FP2 or later where applicable.; For 7.x and 8.x through 8.6, check IBM guidance for supported remediation..

Prepared

Jun 14, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.