Security Bulletin: Due to the use of IBM Db2, IBM Cloud Pak System is affected by multiple vulnerabilities

Summary Multiple vulnerabilities were found in IBM Db2 LUW that affect Platform System Manager PSM and Db2 pattern Type pType shipped with IBM Cloud Pak System. Those vulnerabilities were addressed in IBM Cloud Pak System CPS 2.3.6.2. Vulnerability Details CVEID:CVE-2025-36122 DESCRIPTION: IBM Db...

CVE-2026-3161

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

CVE-2026-4418

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

CVE-2026-3295

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing...

CVE-2023-38375

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2023-38375 IBM Cloud Pak System Cross-Site Scripting

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2023-38375

IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 are vulnerable to cross-site scripting (XSS) (CWE-79). This flaw allows users to embed arbitrary JavaScript code within the Web UI, which can alter intended functionality and potentially lead to credentials disclosure during a trusted session. The...

EUVD-2023-60720

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2026-3161

IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 are vulnerable to the use of weaker than expected cryptographic algorithms (CWE-327). This flaw could enable an attacker to decrypt highly sensitive information. Impact is rated as High for confidentiality. To remediate this vulnerability, IBM str...

EUVD-2026-104522

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

CVE-2026-3161 IBM Cloud Pak System Risky Cryptographic Algorithm

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

CVE-2026-3161 IBM Cloud Pak System Risky Cryptographic Algorithm

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

CVE-2026-3295 IBM Cloud Pak System Cross-Site Scripting

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing...

EUVD-2026-104521

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing...

CVE-2026-3295

IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 are vulnerable to Stored Cross-Site Scripting (Stored XSS) . The root cause is that the web application fails to properly sanitize or HTML-encode user-supplied input before storing and rendering it. An authenticated attacker can exploit this by pr...

EUVD-2026-104520

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

CVE-2026-4418

IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 are vulnerable to HTML injection (CWE-80). A remotely authenticated attacker can inject malicious HTML code that executes within a victim's web browser under the hosting site's security context. This vulnerability was addressed in version 2.3.6.2 ...

CVE-2026-4418 IBM Cloud Pak System HTML Injection

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

CVE-2026-3295: Improper Neutralization of Input During Web Page Generation

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing...

CVE-2026-3161: Use of a Broken or Risky Cryptographic Algorithm

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...