CVE-2014-8918: IBM Security AppScan Standard 8.x and 9.x before 9.0.1.1 FP1 does not properly verify X.509 certificates fr...

Security readout for executives and security teams

IBM Security AppScan Standard could trust forged SSL server certificates in affected versions. An attacker able to intercept network traffic could impersonate a scanned server and capture sensitive information handled by AppScan. This is mainly a risk to organizations still running old AppScan Standard 8.x or 9.x versions before the named fix level. Exposure is limited to environments using IBM Security AppScan Standard 8.x or 9.x before 9.0.1.1 FP1. Risk is higher when AppScan communicates over networks where traffic interception is plausible, such as shared, remote, or untrusted networks. Treat this as a targeted remediation item, not an internet-wide emergency. If the organization used affected AppScan versions for sensitive assessments, prioritize upgrade and exposure review because compromised scanner traffic could reveal credentials, findings, or application details. Mitigation focus: Inventory IBM Security AppScan Standard installations and record exact versions.; Update affected AppScan Standard deployments to 9.0.1.1 FP1 or later where applicable.; Review IBM advisory guidance before relying on compensating controls..

Prepared

Jun 14, 2026, 05:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.