CVE-2026-3295
Received Received - Intake

Stored XSS in IBM Cloud Pak System

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: IBM Corporation

Description
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing malicious JavaScript which are saved within the app and later executed automatically when user views affected pages, resulting in Stored Cross‑Site Scripting (Stored XSS).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-3295
EUVD
EUVD-2026-104521

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
IBM Cloud Pak System 2.3.6.0
IBM Cloud Pak System 2.3.6.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-Site Scripting (Stored XSS) vulnerability in IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1. User input is not properly sanitized or HTML-encoded before being stored and displayed. An authenticated attacker can inject malicious JavaScript payloads that are saved in the application and executed when other users view the affected pages.

Detection Guidance

Detecting this vulnerability requires manual inspection of web application inputs and outputs. Check for improperly sanitized user-supplied input fields in IBM Cloud Pak System interfaces. Look for stored JavaScript payloads in application data or logs. Review web page source code for unencoded HTML special characters in user-provided content.

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of users, or redirect users to malicious sites. Users with administrative privileges are at higher risk as the attacker could gain control over the application or underlying system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations may face compliance penalties, legal liabilities, and reputational damage if exploited.

Mitigation Strategies

Apply IBM's official patches or updates for IBM Cloud Pak System 2.3.6.0 and 2.3.6.1 to address the XSS vulnerability. Ensure input validation and output encoding are implemented to sanitize user-supplied data. Review and restrict user permissions to minimize attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-3295. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart