Cloud Pak System CVE-2026-3295

Exploitation requires an authenticated session on the IBM Cloud Pak System web console (PR:L) with access to an input field whose user-supplied value is stored and later rendered without sanitization or HTML encoding; the specific affected form/field is not named in the advisory. Execution is triggered when a second user (e.g., an administrator or another operator) subsequently views the page that renders the stored payload - the input vector reports no victim interaction beyond normally viewing the affected page (UI:N). Limiting factors: attacker must already possess valid low-privilege credentials, only versions 2.3.6.0 and 2.3.6.1 are listed as affected, and the payload only fires in the browser context of users who view the poisoned page.

This is a moderate-severity stored XSS (CVSS 7.4) that should be patched on a normal maintenance cadence rather than treated as an emergency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L indicates a network-reachable, low-complexity flaw that nevertheless requires the attacker to already hold valid low-privilege credentials (PR:L), which meaningfully narrows the threat population to authenticated users of the Cloud Pak System web console. The elevated 7.4 score is driven largely by the changed scope (S:C) - reflecting that injected JavaScript executes in the browser context of other users/sessions - combined with low impact across confidentiality, integrity, and availability. No EPSS score, KEV listing, or public POC was provided, so there is no evidence of active exploitation or weaponization: this is no public exploit identified at time of analysis. The signals are consistent rather than conflicting (stored XSS requiring an authenticated session aligns with PR:L/S:C), so the main caveat is the absence of exploitation-probability data (EPSS) and the fact that the fix version and affected-version boundaries were not independently verified beyond the single IBM reference. Overall: a real but authenticated, relatively low-impact issue - priority is medium, not critical.

A low-privileged but authenticated user of the IBM Cloud Pak System web console enters a crafted value containing malicious JavaScript into an input field that is stored without proper sanitization or HTML encoding. When an administrator or another user later opens the page that renders that stored value, the script executes automatically in their browser session, allowing session/credential theft or actions performed as the victim. No public exploit code was provided, and exploitation requires valid login credentials, so this is not a mass-exploitable remote-unauthenticated flaw.