Skip to content
CVE-2026-3295: Cross-Site Scripting Vulnerability in IBM Cloud Pak System

CVE-2026-3295: Cross-Site Scripting Vulnerability in IBM Cloud Pak System

First seen 19 Oct 2026, 19:51 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 19, 2026 at 20:51 UTC
  • •CVE-2026-3295 allows stored XSS in IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1.
  • •No known exploitation has been reported, but the risk is significant for exposed deployments.
  • •Upgrade to version 2.3.6.2 to mitigate this and other vulnerabilities.

IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 are vulnerable to cross-site scripting (CVE-2026-3295), allowing authenticated attackers to execute malicious JavaScript in users' browsers. The flaw arises from improper sanitization of user input, leading to stored XSS attacks. Although no known exploitation has been reported, the risk is significant for organizations with broad internal access to the management interface. The vulnerability was disclosed and assigned a CVSS score of 7.4, indicating a high severity. Users are advised to upgrade to version 2.3.6.2, which addresses this and other vulnerabilities. The attack could expose sensitive session data or allow unauthorized actions under user accounts. Monitoring for unusual activity in audit logs is recommended until the patch is applied.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-19
CVE-2026-3295 published
IBM disclosed a cross-site scripting vulnerability in Cloud Pak System, affecting versions 2.3.6.0 and 2.3.6.1.
Redpacketsecurity
2026-10-19
Patch released for vulnerabilities
IBM released version 2.3.6.2 to address CVE-2026-3295 and other vulnerabilities in Cloud Pak System.
IBM

More articles in this cluster (2)

Following this threat?

Track IBM and CVE-2026-3295 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 3

Common questions

Which versions are affected?
IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 are affected by CVE-2026-3295.
Is there a patch available?
Yes, IBM has released version 2.3.6.2 to address this vulnerability.
What should I do if I cannot upgrade immediately?
Limit access to the management interface and monitor for unusual activity until the upgrade can be applied.