Stored Cross-Site Scripting in IBM Cloud Pak System

IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 are affected by a stored cross-site scripting (XSS) vulnerability, identified as CVE-2026-3295. This flaw stems from the application failing to properly sanitize or HTML-encode user-supplied input before it is stored in the system and subsequently rendered in the web interface. An authenticated attacker can exploit this by injecting crafted payloads containing malicious JavaScript into the application. Once stored, this script executes automatically within the browser session of any user - including administrators - who views the affected pages. This behavior poses a significant risk to the integrity and confidentiality of user sessions within the management interface of the Cloud Pak System environment.

Impact

Successful exploitation allows an authenticated attacker to perform unauthorized actions on behalf of other users, potentially leading to session hijacking, unauthorized data access, or the modification of application settings. This vulnerability affects the management web interface of IBM Cloud Pak System 2.3.6.0 and 2.3.6.1, which are typically deployed in enterprise infrastructure management environments.

Recommendation

Prioritize the identification of IBM Cloud Pak System instances running version 2.3.6.0 or 2.3.6.1 within the environment. Monitor web server logs for suspicious HTTP POST requests containing common XSS vectors (e.g., <script>, onerror, onload, or javascript:) targeted at application entry fields. Ensure that all users are aware of the risks associated with suspicious content in the management interface until an official patch is applied by IBM.