EUVD-2026-78156
GHSA-r8hw-r6hm-q7g2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
DoS via CWE-400 with PR:L authenticated network access; no confidentiality or integrity impact applies.
Primary rating from Vendor (us).
CVSS VectorVendor: us
Lifecycle Timeline
1DescriptionCVE.org
IBM Cloud Pak for Business Automation could allow an authenticated user to cause a denial of service due to uncontrolled resource consumption.
AnalysisAI
Uncontrolled resource consumption in IBM Cloud Pak for Business Automation enables authenticated network users to exhaust service resources and trigger a denial of service condition. Affected versions span the 24.0.0, 24.0.1, 25.0.0, and 26.0.0 release lines, each capped at specific interim fix levels. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session with at least low-privilege access to the IBM Cloud Pak for Business Automation platform (PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) contains a significant internal contradiction: it scores C:H (high confidentiality impact) but the description explicitly states denial of service due to uncontrolled resource consumption, and the assigned CWE is CWE-400. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the relevant IBM-supplied interim fix that exceeds the listed upper bound for each release train: for 24.0.0, apply a fix beyond Interim Fix 009; for 24.0.1, apply a fix beyond Interim Fix 008; for 25.0.0, apply a fix beyond Interim Fix 005; and for 26.0.0, apply a fix beyond Interim Fix 001. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today