CVE-2026-3295
7.4HighPublished 19 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Authenticated attackers can run malicious JavaScript in the browsers of users viewing affected pages, allowing session hijacking or unauthorized actions. The attacker needs valid credentials with input access to store the payload.
Root cause
The application fails to sanitize or HTML-encode user input before storing and rendering it in the web interface.
Affected systems
IBM Cloud Pak System 2.3.6.0 and 2.3.6.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Fix & remediation
Upgrade to the remediation version provided in IBM advisory 7290183; no temporary workaround or configuration mitigation is documented.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing malicious JavaScript which are saved within the app and later executed automatically when user views affected pages, resulting in Stored Cross‑Site Scripting (Stored XSS).