IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the …

Medium CVSS 6.4

CVECVE-2026-12749

First seen2026-09-20 02:16 UTC

Disclosed2026-09-15 18:17 UTC

Last updated2026-09-20 02:16 UTC

Channel statusauto

Summary

IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

In-depth triage

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Sources

NVD DATABASE

Original Links

https://www.ibm.com/support/pages/node/7285931

Timeline

2026-09-20 nvd_ingest NVD