CVE-2026-3295

waiting for further signals

GHSA-g698-cvpw-9x59 ↗EUVD-2026-104521 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

IBM Cloud Pak System 2.3.6.0; 2.3.6.1

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

ETK-2026-2396, permanent identifier

cvss7.4cna vendorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

1h 58msince last run

15mAI analysis

timeline

0 = trigger signal

trigger signal (cve.org) +0hwaiting for further signals+60h40m

+2h

+4h

+6h

+8h

+10h

description

IBM Cloud Pak System 2.3.6.0 and 2.3.6.1 contain a stored cross-site scripting flaw in web application input handling. An authenticated attacker may cause script content to run in the browser of a user who views affected stored content.

mitigation

Limit access to trusted authenticated users and restrict exposure of affected web interfaces until IBM provides an update. Review stored user-supplied content and monitor for suspicious submissions.

check

exploit

automation

–

auth required

yes, low privileges

EPSS

–

agent run time

15m

cve.org record, t = 0

2026-10-19 17:39Z

Δ to public poc

–

Δ to kev

–

outcome

No artifact: no remotely reachable path found.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-19 17:39Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-3295

this entry in the feed

GET /api/v1/feed/CVE-2026-3295

{
  "etk_id": "ETK-2026-2396",
  "cve_id": "CVE-2026-3295",
  "display_id": "CVE-2026-3295",
  "ghsa_id": "GHSA-g698-cvpw-9x59",
  "euvd_id": "EUVD-2026-104521",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in IBM Cloud Pak System",
  "summary": "IBM Cloud Pak System 2.3.6.0 and 2.3.6.1 contain a stored cross-site scripting flaw in web application input handling. An authenticated attacker may cause script content to run in the browser of a user who views affected stored content.",
  "mitigation": "Limit access to trusted authenticated users and restrict exposure of affected web interfaces until IBM provides an update. Review stored user-supplied content and monitor for suspicious submissions.",
  "vendor": "IBM",
  "product": "Cloud Pak System",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "2.3.6.0",
        "2.3.6.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Cloud Pak System",
      "purl": null
    }
  ],
  "cwes": [
    79
  ],
  "cvss_score": 7.4,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": null,
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 15.014509983333333,
  "t0_at": "2026-10-19T17:39:49.804000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-19T17:39:49.804000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T17:39:49.804000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-3295"
    }
  }
}

published 2026-10-22 06:04Z
last change 2026-10-22 08:12Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.