PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-6095 IBM CVE debrief

CVE-2016-6095 describes an authentication weakness in IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 where inadequate account lockout settings could let a remote attacker brute-force credentials. NVD rates the issue critical with CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a network-reachable attack surface with severe impact if login protections are bypassed.

Vendor
IBM
Product
Security Key Lifecycle Manager
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-02
Original CVE updated
2026-05-13
Advisory published
2017-02-02
Advisory updated
2026-05-13

Who should care

Administrators and security teams running IBM Tivoli Key Lifecycle Manager 2.5 or 2.6, especially any deployment exposed to remote authentication traffic. Identity and access management teams should also review account lockout and login throttling controls.

Technical summary

The vulnerability is mapped by NVD to CWE-284 (Improper Access Control) and is described as inadequate account lockout handling. The affected CPEs in the supplied NVD record include IBM Security Key Lifecycle Manager 2.5.0 through 2.5.0.7 and 2.6.0 through 2.6.0.2. The IBM PSIRT reference in the corpus points to a vendor advisory and patch guidance.

Defensive priority

Immediate

Recommended defensive actions

  • Review the IBM PSIRT advisory referenced in the NVD record and apply the vendor-provided update or mitigation for the affected versions.
  • Limit exposure of administrative and authentication interfaces to trusted networks wherever possible.
  • Verify that account lockout, rate limiting, and failed-login thresholds are enabled and appropriately configured.
  • Audit authentication logs for repeated failed logins and unusual credential-spraying patterns.
  • Confirm whether any systems still run IBM Tivoli Key Lifecycle Manager 2.5 or 2.6 and prioritize remediation there first.

Evidence notes

The debrief is based on the supplied NVD record published on 2017-02-02 and its modified entry, which lists IBM Security Key Lifecycle Manager 2.5.0 through 2.5.0.7 and 2.6.0 through 2.6.0.2 as vulnerable. The supplied references include an IBM PSIRT vendor advisory/patch reference and a SecurityFocus VDB entry. The vulnerability is described in the corpus as an inadequate account lockout setting that could allow remote brute-force credential attacks.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-6095 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-6095

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-6095 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-6095

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.