What’s Vulnerable › Vulnerabilities
CVE-2026-11864: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-15 · updated 2026-09-16
- Weakness: CWE-643
Description
IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 through 24.0.0 Interim Fix 009 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to exfiltrate sensitive application data and/or determine the structure of the XML document.
Affected products
- IBM Cloud Pak for Business Automation: from 26.0.0 through 26.0.0 Interim Fix 001; from 25.0.0 through 25.0.0 Interim Fix 005; from 24.0.1 through 24.0.1 Interim Fix 008; from 24.0.0 through 24.0.0 Interim Fix 009
References
Get alerted when CVE-2026-11864 or the next vulnerability affects your stack