CVE-2026-14350
Received Received - Intake

Log Injection Vulnerability in IBM Cloud Pak for Data System

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: IBM Corporation

Description
IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-14350
EUVD
EUVD-2026-71492

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ibm cloud_pak_for_data_system 11.3.0.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-117 The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 allows an unauthorized user to inject data into log messages. This happens because the system does not properly neutralize special elements when writing to log files, potentially allowing malicious input to be logged.

Detection Guidance

This vulnerability involves unauthorized data injection into log files. To detect it, review IBM Cloud Pak for Data System logs for unusual entries or unexpected data patterns. Check for logs containing special characters or content that does not match normal system behavior. Compare log files against known good baselines if available.

Impact Analysis

An attacker could exploit this to inject false or misleading information into logs, which may obscure real security events or create confusion during incident investigations. This could hinder detection of actual breaches or attacks.

Compliance Impact

This vulnerability could allow unauthorized data injection into logs, potentially violating confidentiality and integrity requirements in standards like GDPR and HIPAA. Unauthorized log modifications may lead to non-compliance with audit and data protection mandates.

Mitigation Strategies

Apply the latest Interim Fix for IBM Cloud Pak for Data System 11.3.0.2 to address improper neutralization of special elements in log files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14350. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart