Cloud Pak for Data System CVE-2026-14350

No special configuration or authentication is required beyond network reachability to an IBM Cloud Pak for Data System instance running versions 11.3.0.2 through Interim Fix 001, as the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates fully unauthenticated network exploitation. Exploitation is bounded in impact to log integrity manipulation only - an attacker cannot exfiltrate data, gain elevated access, or cause service disruption through this vulnerability in isolation. Meaningful downstream harm requires that the forged log entries reach a security-decision process such as a SIEM alerting rule, a compliance audit review, or an incident-response workflow that treats log records as authoritative.

The CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) is consistent with the actual impact: a low-complexity, unauthenticated network attack that only affects log integrity. EPSS data is not provided in the input, leaving exploitation likelihood unquantified; this CVE is not listed in CISA KEV and no public exploit has been identified. The practical risk is log tampering - which can complicate incident response, mislead SIEM correlation rules, and potentially obscure attacker activity in subsequent intrusions - rather than direct system compromise. Even a mid-sized enterprise IT team in kielce relying on Cloud Pak for Data System audit logs for compliance reporting faces a meaningful exposure to audit-trail falsification, though this does not warrant emergency-level response absent active exploitation signals. The CVSS score does not appear inflated; the primary concern is secondary risk to monitoring infrastructure rather than the direct flaw itself.

An unauthenticated attacker sends an HTTP request to a reachable Cloud Pak for Data System endpoint, embedding CRLF sequences in a parameter that the platform writes to its log files. The injected payload inserts a synthetic log entry - for example, mimicking a successful authentication event - which subsequently misleads security analysts reviewing audit trails or triggers false-negative conditions in SIEM rules that parse log structure for anomaly detection.