Cloud Pak System CVE-2026-3161

Exploitation requires the attacker to first obtain the data that Cloud Pak System protects with the weak cryptographic algorithm (CWE-327) - i.e. access to the encrypted sensitive information in transit or at rest - and then perform cryptanalysis to decrypt it. The CVSS High attack complexity (AC:H) reflects this: the attacker must be positioned to capture the protected ciphertext and expend cryptanalytic effort, which materially limits real-world exploitation despite the unauthenticated network vector (PR:N/UI:N). It applies only to Cloud Pak System versions 2.3.6.0 and 2.3.6.1; no non-default configuration toggle is named in the description, so the weakness appears inherent to how these versions encrypt the affected data.

This is a moderate-severity cryptographic weakness (CVSS 5.9) in IBM Cloud Pak System, best characterized as a high-CVSS-component-but-constrained-real-risk issue rather than an urgent priority. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates a network-reachable flaw requiring no authentication or user interaction, but the High attack complexity (AC:H) is the dominant limiting factor - exploiting a CWE-327 weak-algorithm flaw typically requires the attacker to first obtain the encrypted data and then invest significant cryptanalytic effort or special positioning to decrypt it. Impact is confidentiality-only (C:H/I:N/A:N): sensitive data can be disclosed, but integrity and availability are untouched. No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public exploit code was indicated, so exploitation status is: no public exploit identified at time of analysis. The signals are internally consistent (network vector with high complexity aligns with a crypto-decryption scenario); the main missing signal is any quantitative exploitation probability (EPSS), which prevents a data-driven likelihood estimate.

An attacker who can capture encrypted sensitive data in transit or at rest from an affected Cloud Pak System deployment leverages the weak cryptographic algorithm to decrypt it offline, recovering highly sensitive information. The high attack complexity means success depends on obtaining the ciphertext and performing cryptanalysis, so this is not a trivial push-button attack. No public exploit code was identified in the provided intelligence.