PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-6105 IBM CVE debrief

CVE-2016-6105 is a high-severity access-control flaw in IBM Tivoli Key Lifecycle Manager 2.5 and 2.6. According to NVD, the issue stems from a missing authentication check for a critical resource or function, which allows anonymous users to reach protected areas. The CVE was published on 2017-02-01.

Vendor
IBM
Product
Security Key Lifecycle Manager
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-01
Original CVE updated
2026-05-13
Advisory published
2017-02-01
Advisory updated
2026-05-13

Who should care

Administrators and security teams responsible for IBM Tivoli Key Lifecycle Manager deployments, especially systems running the affected 2.5 and 2.6 release lines listed in NVD.

Technical summary

NVD maps this issue to CWE-284 (Improper Access Control) and assigns CVSS 3.0 vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N (8.2 HIGH). The vulnerability affects multiple IBM Security Key Lifecycle Manager 2.5.x and 2.6.x versions in the supplied CPE list, and the core failure is that a critical protected resource/functionality does not perform an authentication check, enabling anonymous access.

Defensive priority

High. The vulnerability is network-reachable, requires no privileges or user interaction, and can expose protected functionality. Prioritize any exposed IBM Tivoli Key Lifecycle Manager instance in the affected release families.

Recommended defensive actions

  • Apply IBM’s vendor guidance and patching referenced in the IBM PSIRT advisory for this CVE.
  • Inventory IBM Tivoli Key Lifecycle Manager deployments and verify whether they are on the affected 2.5.x or 2.6.x versions listed by NVD.
  • Restrict network exposure to the management interface until the vendor fix is confirmed applied.
  • Verify that protected resources and administrative functions are not reachable without authentication after remediation.
  • Review access logs for unexpected anonymous requests to Key Lifecycle Manager endpoints.

Evidence notes

Primary evidence comes from the official NVD CVE entry and the CVE record. NVD states the vulnerability is an authentication/access-control failure (CWE-284) and includes affected IBM Security Key Lifecycle Manager CPEs for 2.5.x and 2.6.x. IBM’s referenced support document is tagged as a patch/vendor advisory in the NVD references. No KEV enrichment was supplied.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-6105 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-6105

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-6105 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-6105

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.