CVE-2026-11864: medium-severity vulnerability in IBM Cloud Pak for Business Automation
Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.4%
IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 through 24.0.0 Interim Fix 009 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to exfiltrate sensitive application data and/or determine the structure of the XML document.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
IBM · Cloud Pak for Business AutomationRelated CVEs — IBM Cloud Pak for Business Automation
In the same product, most dangerous first.
CVE-2023-40691MEDIUMIBM Cloud Pak for Business Automation information disclosureEPSS 0.7%CVE-2023-50959MEDIUMIBM Cloud Pak for Business Automation information disclosureEPSS 0.5%CVE-2025-1838MEDIUMIBM Cloud Pak for Business Automation denial of serviceEPSS 0.4%CVE-2023-35024MEDIUMIBM Cloud Pak for Business Automation cross-site scriptingEPSS 0.4%CVE-2023-22860MEDIUMIBM Cloud Pak for Business Automation cross-site scriptingEPSS 0.4%CVE-2026-12759MEDIUMMultiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.EPSS 0.4%