IBM Cloud Pak System Cross-Site Scripting
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing malicious JavaScript which are saved within the app and later executed automatically when user views affected pages, resulting in Stored Cross‑Site Scripting (Stored XSS).
CVE-2026-3295
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-3295
Cloud Pak System
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"cpes": [
"cpe:2.3:a:ibm:cloud_pak_system:2.3.6.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_system:2.3.6.1:*:*:*:*:*:*:*"
],
"vendor": "IBM",
"product": "Cloud Pak System",
"versions": [
{
"status": "affected",
"version": "2.3.6.0"
},
{
"status": "affected",
"version": "2.3.6.1"
}
]
}
]- Related CVEs
- CVE-2026-3295
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #39781 · Revision 1
- Added to Heist Feed
- Publisher date