---
id: CVE-2026-9825
title: IBM Cyber Fraud Reachable Assertion
summary: >-
  IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing
  sensitive cookies to be transmitted over unencrypted connections, potentially
  enabling an attacker to intercept session data through network-based attacks.
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-617
vendor: IBM
product: CyberFraud
affected:
  - CyberFraud >= 1.0.0 <= 1.0.2
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T22:02:54.216Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-9825'
references:
  - url: 'https://www.ibm.com/support/pages/node/7290671'
tags:
  - cve.org
ingestedAt: '2026-10-20T22:23:33.692Z'
---

## Overview

IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks.

## Affected

- `CyberFraud >= 1.0.0 <= 1.0.2`

## Remediation

IBM strongly encourages customers to update their systems promptly.



Please upgrade to at least version 1.1.0 according to the following instructions:

 https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=installing-cyber-fraud 



 https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=upgrading-cyber-fraud