What is the CVSS score of CVE-2026-12762?

CVE-2026-12762 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-12762?

Yes, a patch is available for CVE-2026-12762. Update the affected software to the latest version immediately.

Cloud Pak Automation CVE-2026-12762

EUVD-2026-53434 MEDIUM

Insertion of Sensitive Information into Externally-Accessible File (CWE-538)

2026-08-05 ibm

GHSA-pxfx-pc9f-jppf

Information Disclosure IBM Cloud Pak For Business Automation

5.3

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible manifest files require no auth or interaction; confidentiality impact is low since integrity and availability are unaffected.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 16:38 vuln.today

DescriptionCVE.org

IBM Cloud Pak For Business Automation 24.0.0, 24.0.1, 25.0.0, and 26.0.0 could allow a remote attacker to obtain sensitive information exposed in manifest files.

AnalysisAI

Unauthenticated remote information disclosure in IBM Cloud Pak for Business Automation 24.0.0 through 26.0.0 allows network attackers to retrieve sensitive data embedded in externally accessible manifest files. The vulnerability stems from CWE-538, where sensitive configuration or operational data is written into manifest files that are not adequately protected from external access. No public exploit has been identified at time of analysis, and a vendor patch is available via IBM's support portal.

Technical ContextAI

CWE-538 (Insertion of Sensitive Information into Externally-Accessible File or Directory) is the root cause class, indicating that IBM Cloud Pak for Business Automation writes sensitive data - potentially credentials, API keys, internal hostnames, or configuration parameters - into manifest files that can be retrieved over the network without authentication. IBM Cloud Pak for Business Automation is a containerized, cloud-native automation suite typically deployed on Red Hat OpenShift. Manifest files in such environments are often Kubernetes or OpenShift deployment descriptors, Helm chart outputs, or application-level configuration manifests. The CPE cpe:2.3:a:ibm:cloud_pak_for_business_automation:*:*:*:*:*:*:*:* confirms the affected product is IBM's own software layer, not an underlying open-source component, and spans all tracked versions 24.0.0, 24.0.1, 25.0.0, and 26.0.0.

RemediationAI

The primary remediation is to apply the vendor-released patch documented at https://www.ibm.com/support/pages/node/7282605. No specific fixed version number was provided in the available data, so administrators should consult the IBM support page directly to identify the exact interim fix or iFix package applicable to their installed version (24.0.0, 24.0.1, 25.0.0, or 26.0.0). As a compensating control prior to patching, administrators should restrict network access to the manifest file paths through OpenShift route policies, Kubernetes NetworkPolicy rules, or web application firewall rules to limit exposure to trusted internal networks only. Additionally, auditing existing manifests for embedded secrets and rotating any exposed credentials is advisable regardless of patch status.