CVE-2016-9992: IBM Kenexa LCMS Premier on Cloud 9.0, and 10.0.0 is vulnerable to SQL injection.

Security readout for executives and security teams

CVE-2016-9992 is a SQL injection issue in IBM Kenexa LCMS Premier on Cloud. A remote attacker could use crafted SQL statements to access or change back-end database information. For affected learning-management deployments, the main business risk is unauthorized exposure, alteration, or deletion of training and user data. Exposure is likely limited to organizations using IBM Kenexa LCMS Premier on Cloud versions listed in the CVE data. Because this is a cloud product, confirm tenant/version status and remediation through IBM support or the service owner rather than assuming local infrastructure exposure. Prioritize this for any organization that used affected Kenexa LCMS Premier on Cloud versions, especially where the platform stores employee, training, or compliance data. Urgency is driven by possible database compromise, but confidence is limited by missing CVSS and patch details. Mitigation focus: Check IBM advisory 1992067 for vendor remediation guidance.; Confirm whether current or historical Kenexa LCMS tenants used affected versions.; Ask IBM support to verify patch or service-side remediation status..

Prepared

Jun 13, 2026, 06:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.