CVE-2026-3684 · Infrastructure
NO FIX YET
IBM Cloud Pak for Data System builds 11.3.1.2 Interim Fix 001 through Interim Fix 002 assign incorrect file permissions. A user who already has administrative privileges can read and write arbitrary files on the system.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running IBM Cloud Pak for Data System appliances on the affected 11.3.1.2 interim fix builds. The flaw needs an account with administrative privileges, so exposure depends on who holds those accounts. Systems on other builds are not named in the advisory.
Not affected if no-admin-accounts-untrusted
Who cares appliance, ibm-cloud-pak-for-data, on-prem
No fix yet, per the sources.
IBM Cloud Pak for Data System 11.3.1.2 Interim Fix 001 through - 11.3.1.2 Interim Fix 002 could allow a user with administrative privileges to read and write arbitrary files on the system due to incorrect permission assignments.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.