CVE-2020-4430: IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to travers...

Security readout for executives and security teams

IBM Data Risk Manager has a directory traversal flaw that lets a logged-in remote attacker download arbitrary files from the server. Although the CVSS score is medium, CISA KEV listing means exploitation is known, so internet-accessible or broadly reachable deployments deserve urgent attention. Exposure is most likely where IBM Data Risk Manager is deployed and reachable by authenticated users over a network. Prioritize systems running 2.0.1, 2.0.2, 2.0.3, or 2.0.4, and verify 2.0.5 and 2.0.6 because the bundle contains conflicting affected-version data. Treat this as urgent for any reachable IBM Data Risk Manager deployment. The business risk is unauthorized file access from a security platform, combined with CISA known-exploited status. Patch or isolate affected systems promptly and verify logs for possible historical access. Mitigation focus: Review IBM advisory 6206875 and X-Force 180535 for the official fixed version or interim guidance.; Upgrade affected IBM Data Risk Manager deployments according to IBM guidance.; Restrict network access to the Data Risk Manager interface to trusted administrative networks..

Prepared

May 22, 2026, 05:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.