CVE-2016-5959: IBM Security Privileged Identity Manager 2.0.2 and 2.1.0 stores sensitive information in URL parameters.

Security readout for executives and security teams

IBM Security Privileged Identity Manager 2.0.2 and 2.1.0 may put sensitive information into URLs. Those URLs can be retained in logs, browser history, or referrer headers, creating an information disclosure risk if unauthorized people can access those records. Exposure is limited to organizations running IBM Security Privileged Identity Manager 2.0.2 or 2.1.0. Risk increases where URLs are logged centrally, retained in proxies, visible in analytics, or accessible to administrators beyond the SPIM security boundary. Treat this as a targeted hygiene and containment issue, not an internet-wide emergency based on current evidence. Prioritize if SPIM manages privileged accounts, logs are broadly accessible, or historical URL records are retained for long periods. Mitigation focus: Confirm whether IBM Security Privileged Identity Manager 2.0.2 or 2.1.0 is deployed.; Review IBM advisory swg22003092 for supported fixes or configuration guidance.; Restrict access to web server, proxy, application, and SIEM logs containing SPIM URLs..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.