The vulnerability involves the use of weaker-than-expected cryptographic algorithms in versions 2.3.6.0 and 2.3.6.1 of IBM Cloud Pak System. Because of this weakness an attacker with access to encrypted data could potentially decrypt highly sensitive information, resulting in a compromise of confidentiality. The weakness is identified as CWE‑327, which describes the use of insecure cryptographic primitives.

Affected systems are IBM Cloud Pak System releases 2.3.6.0 and 2.3.6.1. No other product versions are currently known to be impacted and no additional vulnerabilities are reported for earlier or later releases.

The CVSS score of 5.9 indicates a moderate severity. EPSS is not available, and the weakness is not listed in the CISA KEV catalog, suggesting no known active exploitation. The primary attack vector is not explicitly documented; it can be inferred that compromise would require access to encrypted data or the ability to influence cryptographic operations. As a result, the risk is considered moderate, primarily affecting confidentiality while other security properties remain intact.