IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 contain a flaw that allows a remotely authenticated attacker to inject arbitrary HTML content. When a victim accesses the affected interface, the browser executes the malicious HTML in the security context of the hosting site. This client‑side code execution could compromise confidentiality or integrity of the web application state, but no direct remote code execution is possible on the server side.

The affected product is IBM Cloud Pak System 2.3.6.0 and 2.3.6.1. No other versions are listed as vulnerable in the vendor's official documentation.

The CVSS score is 5.4, indicating moderate severity. The attack requires valid user credentials, limiting the attacker scope to users who have authenticated access. EPSS data is unavailable, and the vulnerability is not in the CISA KEV catalog, so no publicly known exploitation is reported to date. However, exposed management interfaces or privileged accounts increase risk, warranting prompt mitigation.