PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-6042 IBM CVE debrief

CVE-2016-6042 is a high-severity IBM AppScan Enterprise Edition vulnerability that can lead to arbitrary code execution in the context of the victim user. The issue is tied to improper handling of objects in memory (CWE-119) and is triggered when a victim opens specially crafted content. NVD rates the issue CVSS 3.0 7.3 (High) with local access, low privileges, and user interaction required.

Vendor
IBM
Product
Security Appscan
CVSS
HIGH 7.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-01
Original CVE updated
2026-05-13
Advisory published
2017-02-01
Advisory updated
2026-05-13

Who should care

Organizations running IBM Security AppScan Enterprise Edition, especially the vulnerable versions listed in NVD, should treat this as important if users may open untrusted or specially crafted content. Security teams, application owners, and desktop or endpoint administrators responsible for AppScan deployments should prioritize remediation.

Technical summary

NVD identifies CWE-119 (improper restriction of operations within the bounds of a memory buffer) as the underlying weakness. The vulnerable CPEs listed include IBM Security AppScan 9.0.0.0 and enterprise editions 9.0.0.1, 9.0.1.0, 9.0.1.1, 9.0.2.0, 9.0.2.1, 9.0.3.0, and 9.0.3.1. The CVSS v3.0 vector is AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, indicating exploitation depends on user interaction and can have full confidentiality, integrity, and availability impact once triggered.

Defensive priority

High for any environment that uses affected IBM Security AppScan Enterprise versions. Even though exploitation requires user interaction, the potential impact is severe and the vulnerability is capable of arbitrary code execution.

Recommended defensive actions

  • Review IBM's advisory and apply the vendor patch or upgrade guidance referenced in the official IBM support notice.
  • Inventory IBM Security AppScan Enterprise installations and confirm whether any affected versions are deployed.
  • Limit exposure to untrusted or specially crafted content wherever possible, and train users to avoid opening unknown files or content in affected workflows.
  • Prioritize remediation on systems where AppScan is installed with user-facing access or where content is routinely imported from external sources.
  • After patching, validate the installed version against IBM's guidance and document remediation status.

Evidence notes

The CVE record and NVD detail identify IBM Security AppScan Enterprise Edition as the affected product family. NVD provides the vulnerable version list, CWE-119 classification, and the CVSS v3.0 vector AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. The IBM support advisory is referenced by NVD as a patch/vendor advisory source.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-6042 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-6042

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-6042 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-6042

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.