CVE-2026-11864

published 2026-09-15

CVE-2026-11864: IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and…

Priority P3 38 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C H I N A N

IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 through 24.0.0 Interim Fix 009 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to exfiltrate sensitive application data and/or determine the structure of the XML document.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
ibm	cloud_pak_for_business_automation	24.0.0 – 24.0.0 Interim Fix 009	—
ibm	cloud_pak_for_business_automation	24.0.1 – 24.0.1 Interim Fix 008	—
ibm	cloud_pak_for_business_automation	25.0.0 – 25.0.0 Interim Fix 005	—
ibm	cloud_pak_for_business_automation	26.0.0 – 26.0.0 Interim Fix 001	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-643