CVE-2026-13463
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of credentials into log files.
Risk Assessment
A person with local system access can read log files and obtain credentials, potentially leading to privilege escalation or unauthorized access.
Recommendation
Secure log files against unauthorized access and consider applying a fix from IBM that prevents credentials from being written to logs.
Other vulnerabilities in IBM Cloud Pak System
See all- CVE-2026-4418Medium
IBM Cloud Pak System 2.3.6.0 and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code that, when viewed, is executed in the victim's web browser within the security context of the hosting site.
- CVE-2026-3295High
IBM Cloud Pak System 2.3.6.0 and 2.3.6.1 is vulnerable to cross-site scripting. User-supplied input is not properly sanitized or HTML-encoded before being stored and rendered, allowing an authenticated attacker to store malicious JavaScript (Stored XSS).
- CVE-2026-3161Medium
IBM Cloud Pak System 2.3.6.0 and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- CVE-2023-38375Medium
IBM Cloud Pak System 2.3.6.0 and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI, thus altering the intended functionality and potentially leading to credentials disclosure within a trusted session.
Original NVD description (English source)
IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of credentials into log files.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS