PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-6095 IBM CVE debrief

CVE-2016-6095 describes an authentication weakness in IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 where inadequate account lockout settings could let a remote attacker brute-force credentials. NVD rates the issue critical with CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a network-reachable attack surface with severe impact if login protections are bypassed.

Vendor
IBM
Product
CVE-2016-6095
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-02
Original CVE updated
2026-05-13
Advisory published
2017-02-02
Advisory updated
2026-05-13

Who should care

Administrators and security teams running IBM Tivoli Key Lifecycle Manager 2.5 or 2.6, especially any deployment exposed to remote authentication traffic. Identity and access management teams should also review account lockout and login throttling controls.

Technical summary

The vulnerability is mapped by NVD to CWE-284 (Improper Access Control) and is described as inadequate account lockout handling. The affected CPEs in the supplied NVD record include IBM Security Key Lifecycle Manager 2.5.0 through 2.5.0.7 and 2.6.0 through 2.6.0.2. The IBM PSIRT reference in the corpus points to a vendor advisory and patch guidance.

Defensive priority

Immediate

Recommended defensive actions

  • Review the IBM PSIRT advisory referenced in the NVD record and apply the vendor-provided update or mitigation for the affected versions.
  • Limit exposure of administrative and authentication interfaces to trusted networks wherever possible.
  • Verify that account lockout, rate limiting, and failed-login thresholds are enabled and appropriately configured.
  • Audit authentication logs for repeated failed logins and unusual credential-spraying patterns.
  • Confirm whether any systems still run IBM Tivoli Key Lifecycle Manager 2.5 or 2.6 and prioritize remediation there first.

Evidence notes

The debrief is based on the supplied NVD record published on 2017-02-02 and its modified entry, which lists IBM Security Key Lifecycle Manager 2.5.0 through 2.5.0.7 and 2.6.0 through 2.6.0.2 as vulnerable. The supplied references include an IBM PSIRT vendor advisory/patch reference and a SecurityFocus VDB entry. The vulnerability is described in the corpus as an inadequate account lockout setting that could allow remote brute-force credential attacks.

Official resources

Public debrief prepared from the supplied official CVE/NVD corpus and IBM reference links. No independent validation or exploit testing was performed.