IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing malicious JavaScript which are saved within the app and later executed automatically when user views affected pages, resulting in Stored Cross‑Site Scripting (Stored XSS).
**Risk verdict:** Prioritise remediation for exposed deployments: supplied SSVC data indicates no known exploitation, but KEV, PoC and EPSS status are unavailable.
**Why this matters:** Stored script execution can target privileged operators when they later view affected content, potentially exposing session data or enabling actions under their account. The reported impact is limited, but compromise of a management interface could provide a foothold for further abuse; the extent depends on user privileges and connected systems.
**Most likely attack path:** A network-reachable attacker with a low-privilege account submits malicious content, which executes in another user’s browser without a separate interaction trigger. The changed security scope means consequences may extend beyond the vulnerable application’s security boundary, though the data does not establish a route to lateral movement.
**Who is most exposed:** Organisations running Cloud Pak System or its associated software suites, especially where the management interface is reachable by broad internal user groups or remotely.
Review audit logs for unusual writes to fields later rendered in shared views.
Look for script-like payloads in application records and user-generated content.
Investigate unexpected browser-originated requests following access to affected pages.
Check for anomalous privileged actions or session use after content was viewed.
Mitigation and prioritisation:
Upgrade to the vendor-fixed release; confirm the fix across associated software components.
Restrict interface access to trusted administration networks and minimise user privileges.
Until upgraded, limit who can create or edit content displayed to other users.
Test the upgrade in staging, then deploy promptly with monitoring for regressions.
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
