PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-3046 IBM CVE debrief

CVE-2016-3046 is a SQL injection vulnerability in IBM Security Access Manager products. NVD links the issue to IBM Security Access Manager for Web 8.0 firmware, IBM Security Access Manager for Mobile, and IBM Security Access Manager 9.0 firmware. The NVD CVSS v3.0 vector shows network access, low complexity, high privileges required, no user interaction, and limited confidentiality impact.

Vendor
IBM
Product
Security Access Manager For Mobile
CVSS
LOW 2.7
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-01
Original CVE updated
2026-05-13
Advisory published
2017-02-01
Advisory updated
2026-05-13

Who should care

IBM Security Access Manager administrators, IAM/security operations teams, and application owners running the affected IBM Web, Mobile, or 9.0 firmware components should review exposure and confirm vendor guidance was applied.

Technical summary

The issue is classified as CWE-89 (SQL injection). According to the NVD record, a remote attacker could send specially crafted SQL statements to view information in the back-end database. The CVSS v3.0 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, which indicates remote network reachability but also a high privilege requirement and only limited confidentiality impact.

Defensive priority

Medium. The published CVSS score is low (2.7), but the vulnerability affects identity and access management components and can expose back-end database information if an attacker has the required privileges.

Recommended defensive actions

  • Confirm whether IBM Security Access Manager for Web 8.0 firmware, Security Access Manager for Mobile, or Security Access Manager 9.0 firmware is deployed in your environment.
  • Review IBM’s vendor advisory and apply the referenced patch or remediation guidance from the IBM support document.
  • Restrict and monitor privileged access to the affected components, since the NVD vector requires high privileges.
  • Check logs and database access patterns for unusual queries or unexpected data exposure tied to the affected IBM components.
  • If the affected product is no longer needed, plan upgrade, replacement, or decommissioning to reduce long-term exposure.

Evidence notes

This debrief is based on the official NVD CVE record and the IBM-linked vendor advisory referenced by NVD. The published date in the source is 2017-02-01T20:59:00.847Z, and the record was last modified on 2026-05-13T00:24:29.033Z. NVD lists CWE-89 and the CVSS v3.0 vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. The NVD record references IBM support documentation as the patch/vendor advisory source.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-3046 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-3046

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-3046 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-3046

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.