This vulnerability is a classic SQL injection flaw (CWE-89) that exists in IBM Cloud Pak for Data System – Cyclops in versions 11.3.0.2 through Interim Fix 002. A remote attacker can craft specially formatted SQL statements that are executed against the back‑end database, enabling the attacker to read sensitive data, add new records, modify existing records or delete data altogether. The impact is therefore the loss of confidentiality, integrity, and potentially availability of the database contents.

The affected products are IBM Cloud Pak for Data System – Cyclops. Version 11.3.0.2 is vulnerable, as is any deployment that has not yet applied Interim Fix 002. The fix is delivered in Cyclops 11.3.1.1-WS-ICPDS-CYCLOPS-fp278500.

The CVSS score of 4.3 indicates moderate risk. EPSS is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is remote, through the Cyclops service interface, where an attacker with network connectivity could send malicious queries. Exploitation requires only network access to the service and does not appear to require privileged credentials, making the attack path relatively straightforward for an external adversary.