Cloud Pak Automation CVE-2026-12762

No authentication is required per the CVSS vector (PR:N) and no user interaction is needed (UI:N). The sole prerequisite is network reachability to the IBM Cloud Pak for Business Automation deployment endpoint - specifically, access to the URL path(s) where manifest files are served. Exploitation is limited by: (1) network segmentation - deployments accessible only from internal corporate networks significantly reduce attacker surface; (2) the specific manifest paths must be discoverable or guessable; (3) the confidentiality impact is scoped as 'low' (C:L), meaning the exposed data may be partial or limited in sensitivity depending on what the manifests contain. This is not exploitable against environments where the Cloud Pak web tier is not reachable from the attacker's network segment.

The CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a straightforward network-accessible disclosure requiring no authentication, no user interaction, and no elevated privileges, but with only limited confidentiality impact. This is consistent with an information leakage flaw rather than a direct code execution or data exfiltration primitive. No EPSS probability was provided, and the CVE is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. No POC code is referenced in available data. The practical risk is context-dependent: if the exposed manifest content includes credentials, tokens, or internal network details, it can serve as a stepping stone for further attacks. Organizations should treat this as a meaningful priority if their Cloud Pak deployment is internet-facing or accessible from untrusted network segments, but may reasonably deprioritize relative to higher-severity issues if network access is restricted to internal users.

A remote attacker with network access to the IBM Cloud Pak for Business Automation web interface or API endpoint sends an unauthenticated HTTP GET request targeting known or guessable manifest file paths. The server responds with manifest content containing sensitive information such as internal service credentials or configuration parameters, which the attacker can then use for lateral movement or further reconnaissance. No exploit code is publicly referenced at time of analysis.