CVE-2026-3295: Cloud Pak System 2.3.6.0, 2.3.6.1

Affected technology

Cloud Pak System · 2.3.6.0, 2.3.6.1
IBM

Description’s affected range: 2.3.6.1

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing malicious JavaScript which are saved within the app and later executed automatically when user views affected pages, resulting in Stored Cross‑Site Scripting (Stored XSS). Vendor/CNA’s CVSS 3.1 assessment (base score 7.4/10) rates confidentiality, integrity and availability impact as low.