PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5919 IBM CVE debrief

CVE-2016-5919 is a weak-cryptography issue in IBM Security Access Manager for Web. According to the NVD record and IBM’s advisory reference, affected releases include 7.0.0, 8.0.0, and 9.0.0, and the flaw could allow an attacker to decrypt highly sensitive information. The NVD rates the issue at CVSS 7.5 (HIGH), with network attack vector, no privileges required, and high confidentiality impact.

Vendor
IBM
Product
CVE-2016-5919
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-16
Original CVE updated
2026-05-13
Advisory published
2017-02-16
Advisory updated
2026-05-13

Who should care

Administrators and security teams running IBM Security Access Manager for Web 7.0.0, 8.0.0, or 9.0.0 should prioritize this issue, especially where the product protects credentials, tokens, session material, or other sensitive data.

Technical summary

The NVD assigns CWE-326 (Inadequate Encryption Strength) and a CVSS v3.0 vector of CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. That combination indicates a remotely reachable issue focused on confidentiality rather than integrity or availability. The published description states that weaker than expected cryptographic algorithms could enable decryption of highly sensitive information. The supplied corpus does not name the specific algorithms or the exact attack preconditions beyond the weak-crypto exposure itself.

Defensive priority

High. The issue is remotely reachable, requires no authentication, and can expose sensitive data if the affected cryptographic protections are relied upon.

Recommended defensive actions

  • Check whether IBM Security Access Manager for Web 7.0.0, 8.0.0, or 9.0.0 is deployed anywhere in your environment.
  • Review IBM’s support advisory referenced by the NVD and apply the vendor-recommended fix or update path.
  • Inventory sensitive data protected by the product and assess whether any at-rest or in-transit secrets may have been exposed before remediation.
  • If exposure is suspected, follow your incident response and credential/secrets rotation procedures for impacted material.
  • Validate that any compensating controls or configuration changes recommended by IBM are in place after patching.

Evidence notes

All statements are grounded in the supplied NVD record and its IBM vendor-advisory reference. The record identifies the weakness as CWE-326, gives the CVSS v3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, and describes the impact as decryption of highly sensitive information. The supplied timeline shows the CVE published on 2017-02-16T20:59:00.130Z; no KEV entry was supplied.

Official resources

Publicly disclosed in the supplied NVD record on 2017-02-16. No Known Exploited Vulnerabilities (KEV) entry was provided in the source corpus.