IBM Cloud Pak System 2.3.6.x Stored XSS via Unsanitized User Input
CVE-2026-3295 Published on October 19, 2026
IBM Cloud Pak System Cross-Site Scripting
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app usersupplied input is not properly sanitized or HTMLencoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing malicious JavaScript which are saved within the app and later executed automatically when user views affected pages, resulting in Stored CrossSite Scripting (Stored XSS).
Vulnerability Analysis
CVE-2026-3295 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be low. considered to have a small impact on confidentiality and integrity and availability.
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2026-3295 has been classified to as a XSS vulnerability or weakness.
Products Associated with CVE-2026-3295
Want to know whenever a new CVE is published for IBM Cloud Pak System? stack.watch will email you.
Affected Versions
IBM Cloud Pak System:- Version 2.3.6.0 is affected.
- Version 2.3.6.1 is affected.