CVE-2026-11864 is a vulnerability in IBM Cloud Pak Business Automation
Published on September 15, 2026
Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 through 24.0.0 Interim Fix 009 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to exfiltrate sensitive application data and/or determine the structure of the XML document.
Vulnerability Analysis
CVE-2026-11864 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
What is a XPath Injection Vulnerability?
The software uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query. The net effect is that the attacker will have control over the information selected from the XML database and may use that ability to control application flow, modify logic, retrieve unauthorized data, or bypass important checks (e.g. authentication).
CVE-2026-11864 has been classified to as a XPath Injection vulnerability or weakness.
Products Associated with CVE-2026-11864
Want to know whenever a new CVE is published for IBM Cloud Pak Business Automation? stack.watch will email you.
Affected Versions
IBM Cloud Pak for Business Automation:- Version 26.0.0, <= 26.0.0 Interim Fix 001 is affected.
- Version 25.0.0, <= 25.0.0 Interim Fix 005 is affected.
- Version 24.0.1, <= 24.0.1 Interim Fix 008 is affected.
- Version 24.0.0, <= 24.0.0 Interim Fix 009 is affected.