IBM Cloud Pak System 2.3.6.0 and 2.3.6.1 are vulnerable to a Stored Cross‑Site Scripting flaw. Input supplied through the web application is neither sanitized nor encoded before being stored and later rendered, allowing an attacker to embed malicious JavaScript. When a user views a page that displays the stored data, the script executes automatically, potentially hijacking the user’s session or stealing information. The flaw is a classic example of CWE‑79 and would provide a convenient vector for an attacker to compromise the integrity and confidentiality of affected users’ data.

The affected system is IBM Cloud Pak System, specifically versions 2.3.6.0 and 2.3.6.1. No other vendors or products are listed as impacted in the advisory.

The vulnerability scores a CVSS of 7.4, indicating moderate to high risk. No EPSS data is available, but the lack of measurable exploit probability does not mitigate the severity. The flaw is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be authenticated to the web application, and the stored payload would run in the context of any user who views the affected page.