Skip to main content

IBM Enterprise Records EUVDEUVD-2026-71150

| CVE-2026-81859 MEDIUM
Use of a Broken or Risky Cryptographic Algorithm (CWE-327)
2026-09-04 ibm GHSA-fmfp-h99j-mw6r
Information Disclosure IBM Cloud Pak For Business Automation
6.2
CVSS 3.1 · Vendor: ibm
Share

Severity by source

Vendor (ibm) PRIMARY
6.2 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
6.2 MEDIUM

Local vector confirmed by description; no privileges required to read weakly-encrypted storage artifacts; impact is confidentiality-only with no integrity or availability consequence.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
Analysis Generated
Sep 04, 2026 - 16:06 vuln.today

DescriptionCVE.org

CP4BA - IBM Enterprise Records could allow a local attacker to obtain sensitive information due to the use of a broken or risky cryptographic algorithm.

AnalysisAI

Sensitive information disclosure in IBM Enterprise Records (a component of IBM Cloud Pak for Business Automation) allows a local attacker to recover protected data due to the use of a broken or risky cryptographic algorithm (CWE-327). Affected versions span CP4BA releases 24.0.0 through 26.0.0 up to specific interim fix levels. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires local access to the system or container environment hosting IBM Enterprise Records within CP4BA - AV:L constrains this to attackers who have already obtained a foothold on the host node, a co-located pod, or access to shared persistent storage. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) scores 6.2 (Medium), reflecting a local attack vector with no privilege requirement and high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply IBM-released interim fixes: upgrade CP4BA 24.0.0 to Interim Fix 010 or later, CP4BA 24.0.1 to Interim Fix 009 or later, CP4BA 25.0.0 to Interim Fix 006 or later, and CP4BA 26.0.0 to Interim Fix 002 or later, as documented in the IBM security advisory at https://www.ibm.com/support/pages/node/7285931. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Cloud Pak For Business Automation

View all
CVE-2023-35024 HIGH
7.6 Oct 14

IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21
CVE-2025-1838 MEDIUM
6.5 May 03

IBM Cloud Pak for Business Automation 24.0.0 and 24.0.1 through 24.0.1 IF001 Authoring allows an authenticated user to b
CVE-2026-11864 MEDIUM
6.5 Sep 15

An XPath injection flaw (CWE-643) in IBM Cloud Pak for Business Automation lets an authenticated user manipulate XPath q
CVE-2024-52365 MEDIUM
6.4 Feb 05

IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21
CVE-2025-36436 MEDIUM
6.4 Feb 02

Cloud Pak For Business Automation versions up to 24.0.0 is affected by cross-site scripting (xss) (CVSS 6.4).
CVE-2026-12749 MEDIUM
6.4 Sep 15

Stored cross-site scripting in IBM Cloud Pak for Business Automation allows an authenticated user to plant JavaScript in
CVE-2026-12750 MEDIUM
6.4 Sep 15

Stored cross-site scripting in IBM Cloud Pak for Business Automation allows an authenticated user to persist arbitrary J
CVE-2024-41753 MEDIUM
6.1 May 03

IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF004 and 24.0.1 through 24.0.1 IF001 is vulnerable to cross
CVE-2023-32339 MEDIUM
6.1 Jun 27

IBM Business Automation Workflow is vulnerable to cross-site scripting. Rated medium severity (CVSS 6.1), this vulnerabi
CVE-2024-52364 MEDIUM
5.4 Feb 05

IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21
CVE-2025-36094 MEDIUM
5.4 Feb 03

Cloud Pak For Business Automation versions up to 24.0.0 contains a vulnerability that allows attackers to an authenticat
CVE-2026-12751 MEDIUM
5.4 Sep 15

IBM Cloud Pak for Business Automation is affected by HTML injection (CWE-80) in one or more web UI components, allowing

Same weakness CWE-327 – Use of a Broken or Risky Cryptographic Algorithm

View all
CVE-2022-3365 CRITICAL POC
9.8
CVE-2014-8687 CRITICAL POC
9.8
CVE-2017-17382 MEDIUM POC
5.9
CVE-2016-6602 CRITICAL POC
9.8
CVE-2023-34039 CRITICAL POC
9.8
CVE-2025-2539 HIGH POC
7.5
CVE-2017-9466 CRITICAL POC
9.8
CVE-2023-5347 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-71150 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy