Medium · 6.4 CVE-2025-36436 EUVD-2025-206788GHSA-2rh6-mp5g-j2gf

Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for January 2026.

Published Feb 2, 2026 · Updated Feb 4, 2026 · Assigned by ibm

Vendor: IBM Product: Cloud Pak for Business Automation

Description

IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 007 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected products

Vendor	Product	Affected	Fixed
IBM	Cloud Pak for Business Automation	25.0.0 – ≤ 25.0.0 Interim Fix 002, 24.0.1 – ≤ 24.0.1 Interim Fix 005, 24.0.0 – ≤ 24.0.0 Interim Fix 007	—

Advisories 1

WID-SEC-2026-0273 IBM Business Automation Workflow: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 3, 2026

References

https://www.ibm.com/support/pages/node/7259318 vendor-advisory patch