IBM Cloud Pak System vulnerabilities

37 CVEs affecting IBM Cloud Pak System, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-13463, published 2026-07-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-4521, published 2019-12-10. Critical severity, CVSS 9.8. EPSS: 2.6% chance of exploitation in the next 30 days. Platform System Manager in IBM Cloud Pak System 2.3 is potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv…
CVE-2019-4130, published 2019-12-03. High severity, CVSS 8.8. EPSS: 2% chance of exploitation in the next 30 days. IBM Cloud Pak System 2.3 and 2.3.0.1 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server. IBM X-Force ID: 158280.
CVE-2020-4912, published 2021-01-04. High severity, CVSS 7.2. EPSS: 1.1% chance of exploitation in the next 30 days. IBM Cloud Pak System 2.3 Self Service Console could allow a privilege escalation by capturing the user request URL when logged in as a privileged user. IBM X-Force ID: 191287.
CVE-2023-38273, published 2024-02-02. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Cloud Pak System 2.3.1.1, 2.3.2.0, and 2.3.3.7 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 260733.
CVE-2021-20479, published 2022-05-09. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Cloud Pak System 2.3.0 through 2.3.3.3 Interim Fix 1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID:…
CVE-2020-4916, published 2021-01-04. Medium severity, CVSS 4.8. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially…
CVE-2020-4919, published 2021-01-04. Low severity, CVSS 3.8. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Cloud Pak System 2.3 has insufficient logout controls which could allow an authenticated privileged user to impersonate another user on the system. IBM X-Force ID: 191395.
CVE-2019-4468, published 2019-12-03. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2019-4467, published 2019-12-03. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2019-4226, published 2019-12-03. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…

Latest

CVE-2026-13463, published 2026-07-28. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of credentials into log files.
CVE-2023-38005, published 2026-02-17. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Cloud Pak System 2.3.3.6, 2.3.3.7, 2.3.4.0, 2.3.4.1, and 2.3.5.0 could allow an authenticated user to perform unauthorized tasks due to improper access controls.
CVE-2023-38265, published 2026-02-17. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Cloud Pak System 2.3.3.6, 2.3.3.7, 2.3.4.0, 2.3.4.1, and 2.3.5.0 could disclose folder location information to an unauthenticated attacker that could aid in further attacks against the system.
CVE-2023-38281, published 2026-02-04. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Cloud Pak System does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting…
CVE-2023-38017, published 2026-02-04. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Cloud Pak System is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially…
CVE-2023-38010, published 2026-02-04. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Cloud Pak System displays sensitive information in user messages that could aid in further attacks against the system.
CVE-2025-2895, published 2025-06-30. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, 2.3.4.1, and 2.3.4.1 iFix1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when…
CVE-2023-38007, published 2025-06-27. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Cloud Pak System 2.3.5.0, 2.3.3.7, 2.3.3.7 iFix1 on Power and 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.4.0, 2.3.4.1 on Intel operating systems is vulnerable to HTML injection. A remote attacker…
CVE-2023-38272, published 2025-03-27. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, and 2.3.4.1 could allow a user with access to the…
CVE-2023-37405, published 2025-03-27. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, and 2.3.4.1 stores sensitive data in memory, that could…