EUVD-2026-78156
GHSA-r8hw-r6hm-q7g2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege credentials
-
DeliveryAuthenticate to Cloud Pak platform
-
ExploitSubmit resource-exhausting request or input
-
ExecutionTrigger unthrottled resource allocation
-
PersistExhaust CPU/memory
-
ImpactDeny service to legitimate users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated session with at least low-privilege access to the IBM Cloud Pak for Business Automation platform (PR:L). The platform must be running one of the affected version/interim-fix combinations across the 24.0.0, 24.0.1, 25.0.0, or 26.0.0 release lines. Exploitation is limited by the authentication barrier - unauthenticated external actors cannot trigger this condition. The specific internal feature, API endpoint, or input path triggering the uncontrolled resource consumption is not disclosed in available public data. |
| Impact | The NVD-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) contains a significant internal contradiction: it scores C:H (high confidentiality impact) but the description explicitly states denial of service due to uncontrolled resource consumption, and the assigned CWE is CWE-400. The 'Denial Of Service' tag and CWE-400 both confirm this is an availability-impacting bug, not a confidentiality one. The C:H metric appears to be a data entry error; the correct impact metric should be A:H with C:N. Applying the corrected interpretation yields a score consistent with a 6.5 medium (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Real-world risk is moderate: exploitation requires valid credentials, the product is enterprise-deployed behind authentication controls, and no public exploit or active exploitation is identified. The primary concern is availability impact to business-critical automation workflows. |
| Exploit ScenarioDerived | An authenticated internal user or compromised account with low-privilege access sends specially crafted or high-volume requests to a resource-intensive endpoint within the automation platform, causing the service to allocate CPU or memory without bound. This exhausts available system resources and renders the Cloud Pak for Business Automation services unavailable to other users. No public exploit code exists at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 15, 2026
Uncontrolled resource consumption in IBM Cloud Pak for Business Automation enables authenticated network users to exhaust service resources and trigger a denial of service condition. Affected versions span the 24.0.0, 24.0.1, 25.0.0, and 26.0.0 release lines, each capped at specific interim fix levels. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
RemediationAI
Apply the relevant IBM-supplied interim fix that exceeds the listed upper bound for each release train: for 24.0.0, apply a fix beyond Interim Fix 009; for 24.0.1, apply a fix beyond Interim Fix 008; for 25.0.0, apply a fix beyond Interim Fix 005; and for 26.0.0, apply a fix beyond Interim Fix 001. Consult the IBM advisory at https://www.ibm.com/support/pages/node/7285931 for exact fix designations. As a compensating control prior to patching, restrict authenticated access to the platform to the minimum necessary set of users, and implement network-layer rate limiting or connection throttling on ingress to the Cloud Pak services to limit resource exhaustion impact.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM Cloud Pak for Business Automation is an enterprise automation platform built on Red Hat OpenShift, incorporating capabilities for document processing, workflow automation, and decision management. CWE-400 (Uncontrolled Resource Consumption) describes a class of bugs where an authenticated actor can submit requests or inputs that cause the system to allocate disproportionate CPU, memory, thread, or connection resources without appropriate throttling or quota enforcement. The absence of rate limiting or resource caps on a privileged code path allows a low-privileged authenticated user to saturate the service.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
DoS via CWE-400 with PR:L authenticated network access; no confidentiality or integrity impact applies.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM Cloud Pak for Business Automation could allow an authenticated user to cause a denial of service due to uncontrolled resource consumption.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB