IBM Cloud Pak For Business Automation vulnerabilities

31 CVEs affecting IBM Cloud Pak For Business Automation, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-12751, published 2026-09-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-35899, published 2024-03-21. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is potentially vulnerable to CSV Injection. A remote…
CVE-2023-40691, published 2023-12-18. Medium severity, CVSS 4.9. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 may reveal sensitive information contained in…
CVE-2023-50959, published 2024-03-31. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2,19.0.1, 19.0.2, 19.0.3,20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1,2 2.0.2, 23.0.1, and 23.0.2 may allow end users to query…
CVE-2023-32339, published 2023-06-27. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2025-36092, published 2025-11-03. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause a denial of service due to the improper validation of input length.
CVE-2023-50947, published 2024-02-04. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Business Automation Workflow 22.0.2, 23.0.1, and 23.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the…
CVE-2025-1838, published 2025-05-03. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Cloud Pak for Business Automation 24.0.0 and 24.0.1 through 24.0.1 IF001 Authoring allows an authenticated user to bypass client-side data validation in an authoring user interface which…
CVE-2023-35024, published 2023-10-14. High severity, CVSS 7.6. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This…
CVE-2023-38367, published 2024-02-29. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Cloud Pak Foundational Services Identity Provider (idP) API (IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1,…
CVE-2023-22860, published 2023-02-27. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to stored cross-site scripting.…

Latest

CVE-2026-12751, published 2026-09-15. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Cloud Pak for Business Automation is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the…
CVE-2026-12750, published 2026-09-15. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the…
CVE-2026-12749, published 2026-09-15. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the…
CVE-2026-11864, published 2026-09-15. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 through 24.0.0 Interim Fix 009 is…
CVE-2026-12759, published 2026-09-14. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Cloud Pak for Business Automation could allow an authenticated user to cause a denial of service due to uncontrolled resource consumption.
CVE-2026-12758, published 2026-09-14. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Cloud Pak for Business Automation could allow a remote attacker to bypass authorization and invoke restricted endpoints due to improper validation of HTTP headers.
CVE-2026-81859, published 2026-09-04. Medium severity, CVSS 6.2. EPSS: 0.1% chance of exploitation in the next 30 days. CP4BA - IBM Enterprise Records could allow a local attacker to obtain sensitive information due to the use of a broken or risky cryptographic algorithm.
CVE-2025-36094, published 2026-02-03. High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 007 could allow an authenticated user to…
CVE-2025-36436, published 2026-02-02. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 007 is vulnerable to stored cross-site…
CVE-2025-36172, published 2025-11-03. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 001, 24.0.1 through 24.0.1 Interim Fix 004, 24.0.0 through 24.0.0 Interim Fix 006, and earlier unsupported releases IBM…