What is the CVSS score of CVE-2026-12751?

CVE-2026-12751 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Is there a patch available for CVE-2026-12751?

Yes, a patch is available for CVE-2026-12751. Update the affected software to the latest version immediately.

IBM Cloud Pak for Business Automation CVE-2026-12751

EUVD-2026-78866 MEDIUM

Basic XSS (CWE-80)

2026-09-15 ibm

GHSA-5v8h-pcv3-92v7

XSS IBM Cloud Pak For Business Automation

5.4

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Authenticated low-privilege injection plus victim page view drives PR:L and UI:R; script runs in site origin, so S:C with limited C/I and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 18:07 vuln.today

DescriptionCVE.org

IBM Cloud Pak for Business Automation is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

AnalysisAI

IBM Cloud Pak for Business Automation is affected by HTML injection (CWE-80) in one or more web UI components, allowing an attacker who already holds low-privileged authenticated access to inject markup that executes in a victim's browser within the hosting site's security context. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting a network-reachable, low-complexity flaw that still requires authentication and victim interaction, with scope change because the injected script runs against the site's origin. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a low-privileged authenticated account on the IBM Cloud Pak for Business Automation web UI (CVSS PR:L) and a reachable page or field that reflects or stores attacker-supplied HTML without script-tag or attribute neutralization (CWE-80). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Multiple signals point to a moderate, real-but-bounded risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Patch available per vendor advisory: IBM has published a fix for this HTML injection issue in its support bulletin at https://www.ibm.com/support/pages/node/7285931, which is tagged in the reference data as a patch - apply the fix pack or interim fix level specified there to all Cloud Pak for Business Automation deployments, since the input does not state an exact version string and the version cannot be invented. … Detailed patch versions, workarounds, and compensating controls in full report.