IBM Cloud Pak for Data System 11.3.1.2 IF001-002: Arbitrary File Read/Write
CVE-2026-3684 Published on November 8, 2026
Vulnerabilities exists in IBM Cloud Pak for Data System
IBM Cloud Pak for Data System 11.3.1.2 Interim Fix 001 through - 11.3.1.2 Interim Fix 002 could allow a user with administrative privileges to read and write arbitrary files on the system due to incorrect permission assignments.
Vulnerability Analysis
CVE-2026-3684 is exploitable with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Weakness Type
Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
Products Associated with CVE-2026-3684
Want to know whenever a new CVE is published for IBM Cloud Pak For Data System? stack.watch will email you.
Affected Versions
IBM Cloud Pak for Data System:- Version 11.3.1.2 Interim Fix 001, <= 11.3.1.2 Interim Fix 002 is affected.