IBM Cloud Pak for Business Automation CVE-2026-12758

Exploitation requires a valid authenticated session on the IBM Cloud Pak for Business Automation platform - the attacker must hold at least low-privileged credentials (CVSS PR:L). The target must be running one of the affected interim fix levels: 24.0.0 through 24.0.0-IF009, 24.0.1 through 24.0.1-IF008, 25.0.0 through 25.0.0-IF005, or 26.0.0 through 26.0.0-IF001. The attack is network-reachable (AV:N) with low complexity (AC:L), requiring no special network position, timing, or precondition beyond HTTP access to the platform. Limiting factors include the mandatory authentication step (PR:L) and the typical enterprise deployment pattern, which places Cloud Pak behind corporate network controls, restricting the pool of potential attackers to internal users or those with previously compromised accounts.

The CVSS 3.1 score of 5.4 (Medium) is well-calibrated for this vulnerability - PR:L constrains exploitation to already-authenticated users, C:L/I:L caps impact to partial data exposure and limited integrity effects, and A:N confirms no availability consequence. No CISA KEV listing and no identified public exploit code further reduce near-term exploitation pressure. That said, enterprise automation platforms handling sensitive business process data present attractive lateral movement targets once credentials are obtained, and even a mid-sized municipal IT team in bytom running this platform should treat interim fix deployment as a timely priority given the low attack complexity (AC:L) for any user holding valid credentials. The absence of EPSS data in the provided input precludes a probability-weighted exploitation estimate, but the authentication prerequisite substantially limits the realistic attacker population to insiders or previously compromised accounts.

An attacker with low-privileged credentials to a Cloud Pak for Business Automation instance crafts HTTP requests containing header values engineered to subvert the platform's authorization checks, then sends those requests over the network to endpoints normally restricted to higher-privileged roles. The low attack complexity means no special tooling or timing is required beyond valid credentials and the ability to manipulate request headers. No public exploit code has been identified at time of analysis.