---
id: "CVE-2026-3295"
kind: "vulnerability"
aliases: ["CVE-2026-3295"]
title: "IBM Cloud Pak System: stored XSS lets an authenticated user run scripts"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["ibm-cloud-pak-system", "infrastructure", "self-hosted", "web-ui"]
not_affected_if: ["auth-required"]
published_at: "2026-10-19T18:17:07+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T03:27:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3295", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# IBM Cloud Pak System: stored XSS lets an authenticated user run scripts

IBM Cloud Pak System 2.3.6.0 and 2.3.6.1 do not sanitize or encode user input before storing and rendering it in the web app. An authenticated attacker can save JavaScript that runs in the browser of anyone who later views the affected page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Cloud Pak System version in the appliance console; unknown if the sources give a command.
- Confirm whether the affected version is `2.3.6.0` or `2.3.6.1`.

## Fix

- Move to a fixed Cloud Pak System release; unknown, the sources do not name the fixed version.
- Check the IBM security bulletin for the fix; unknown if the sources give a link.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-3295

## From the sources

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing malicious JavaScript which are saved within the app and later executed automatically when user views affected pages, resulting in Stored Cross‑Site Scripting (Stored XSS).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_