PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9993 IBM CVE debrief

CVE-2016-9993 is a SQL injection vulnerability in IBM Kenexa LCMS Premier on Cloud. According to NVD, affected versions include 9.0 through 10.2, and the issue is rated CVSS 3.0 7.1 (High). A remote attacker with low privileges could send crafted SQL statements and potentially read, add, modify, or delete backend database information.

Vendor
IBM
Product
Kenexa Lcms Premier
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-03-01
Original CVE updated
2026-05-13
Advisory published
2017-03-01
Advisory updated
2026-05-13

Who should care

IBM Kenexa LCMS Premier administrators, application owners, and security teams responsible for versions 9.0 through 10.2, especially where the application is reachable by untrusted users or networks.

Technical summary

NVD classifies this issue as CWE-89 (SQL Injection) and lists the vector CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. The published description says an attacker could use specially crafted SQL statements to interact with the backend database. NVD CPE entries mark IBM Kenexa LCMS Premier versions 9.0, 9.1, 9.2, 9.2.1, 9.3, 9.4, 9.5, 10.0, 10.1, and 10.2 as vulnerable. The NVD record links to IBM reference 1992067 as the vendor advisory/patch reference.

Defensive priority

High for exposed IBM Kenexa LCMS Premier deployments. The confidentiality impact is high and the attack can be network-delivered with only low privileges, so remediation should be prioritized for any affected instance still in service.

Recommended defensive actions

  • Confirm whether IBM Kenexa LCMS Premier versions 9.0 through 10.2 are deployed anywhere in your environment.
  • Review IBM advisory/reference 1992067 and apply the vendor-supplied patch or mitigation guidance if not already done.
  • Restrict access to the application and limit which users can reach database-backed functionality until remediation is complete.
  • Audit application and database logs for anomalous SQL activity or unexpected data access around the affected components.
  • After remediation, validate that the vulnerable versions are no longer reachable and document the fixed state in asset inventory.

Evidence notes

All claims are based on the supplied CVE/NVD corpus and the IBM vendor reference linked from NVD. The CVSS vector, CWE mapping, and vulnerable version list come from the NVD record. No exploit code, reproduction steps, or unsupported remediation claims were added.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-9993 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-9993

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-9993 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-9993

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.