CVE-2019-17334: TIBCO Spotfire Analyst and Desktop Remote Code Execution Via Shared Files

Security readout for executives and security teams

This is a business intelligence desktop/client risk: someone who can write Spotfire DXP files into a shared Spotfire library or network file share could cause code to run under another user's account when that user opens the affected content. It matters most where analysts share Spotfire files from network locations and permissions are broad. Exposure is likely limited to environments running the listed Spotfire versions where users access shared DXP files and attackers or untrusted users can write to the Spotfire library or related network file system. Prioritize remediation where Spotfire supports sensitive analytics, finance, security, or operational decisions and shared file permissions are broad. This is not internet-scale by the provided evidence, but compromise could run code as business users who open affected files. Mitigation focus: Check TIBCO advisory guidance for fixed or supported Spotfire versions.; Upgrade affected Spotfire Analyst, Desktop, Deployment Kit, and related components per vendor guidance.; Restrict write access to Spotfire libraries and shared network file systems..

Prepared

May 24, 2026, 01:29 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.