CVE-2014-0866: RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics send...

Security readout for executives and security teams

IBM Algo Credit Limits used RICOS to send credentials over HTTP in affected 4.5.0 through pre-4.7.0.03 FP5 releases. Anyone able to observe that network traffic could capture login credentials. This is mainly urgent for organizations still running the legacy Algorithmics platform. Exposure is likely limited to environments that still operate IBM Algorithmics Algo Credit Limits/ACLM with RICOS in the affected version range and permit HTTP credential exchange on observable networks. Treat as high priority only where this legacy IBM financial risk platform is present. The business issue is credential compromise, which can lead to unauthorized access even without malware or system takeover. Mitigation focus: Confirm whether ACLM/RICOS is present and identify exact versions.; Apply IBM's fixed level, 4.7.0.03 FP5 or later, where supported.; Review IBM support guidance for any product-specific configuration mitigations..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.