CVE-2026-12758

Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

Published Sep 14, 2026 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Description

IBM Cloud Pak for Business Automation could allow a remote attacker to bypass authorization and invoke restricted endpoints due to improper validation of HTTP headers.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

IBM

Cloud Pak for Business Automation

affected

Version	Status	Constraints
`26.0.0`	affected	≤ 26.0.0 Interim Fix 001
`25.0.0`	affected	≤ 25.0.0 Interim Fix 005
`24.0.1`	affected	≤ 24.0.1 Interim Fix 008
`24.0.0`	affected	≤ 24.0.0 Interim Fix 009

No data.

Vendor Product Versions

Ibm

Cloud Pak For Business Automation

Version	Status	Scheme	Platform
`[26.0.0,26.0.0 Interim Fix 001]`	affected	generic	—
`[25.0.0,25.0.0 Interim Fix 005]`	affected	generic	—
`[24.0.1,24.0.0 Interim Fix 008]`	affected	generic	—
`[24.0.0,24.0.0 Interim Fix 009]`	affected	generic	—

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now. Affected Product(s)Version(s)Remediation / FixIBM Cloud Pak for Business AutomationV26.0.0 - V26.0.0-IF001Apply security fix 26.0.0-IF002 https://www.ibm.com/support/pages/readme-ibm-cloud-pak-business-automation-2600-if002 IBM Cloud Pak for Business AutomationV25.0.0 - V25.0.0-IF005Apply security fix 25.0.0-IF006 https://www.ibm.com/support/pages/readme-ibm-cloud-pak-business-automation-2500-if006 IBM Cloud Pak for Business AutomationV24.0.1 - V24.0.1-IF008Apply security fix 24.0.1-IF009 https://www.ibm.com/support/pages/readme-ibm-cloud-pak-business-automation-2401-if009 IBM Cloud Pak for Business AutomationV24.0.0 - V24.0.0-IF009Apply security fix 24.0.0-IF010 https://www.ibm.com/support/pages/readme-ibm-cloud-pak-business-automation-2400-if010 Any open source library may be included in one or more sub-components of IBM Cloud Pak for Business Automation. Open source updates are not always synchronized across all components.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.304% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.ibm.com/support/pages/node/7285931

History

Sep 15, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 14, 2026 9:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		IBM Cloud Pak for Business Automation could allow a remote attacker to bypass authorization and invoke restricted endpoints due to improper validation of HTTP headers.
Title		Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
First Time appeared		Ibm Ibm cloud Pak For Business Automation
Weaknesses		CWE-862
CPEs		cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:::::::* cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:interim_fix_009:::::: cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:::::::* cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:interim_fix_008:::::: cpe:2.3:a:ibm:cloud_pak_for_business_automation:25.0.0:::::::* cpe:2.3:a:ibm:cloud_pak_for_business_automation:25.0.0:interim_fix_005:::::: cpe:2.3:a:ibm:cloud_pak_for_business_automation:26.0.0:::::::* cpe:2.3:a:ibm:cloud_pak_for_business_automation:26.0.0:interim_fix_001::::::
Vendors & Products		Ibm Ibm cloud Pak For Business Automation
References		https://www.ibm.com/support/pages/node/7285931
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}`