---
id: CVE-2026-4418
title: IBM Cloud Pak System HTML Injection
summary: >-
  IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A
  remotely authenticated attacker could inject malicious HTML code, which when
  viewed, would be executed in the victim's Web browser within the security
  context o…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-80
vendor: IBM
product: Cloud Pak System
affected:
  - cloud_pak_system 2.3.6.0
  - cloud_pak_system 2.3.6.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-19T18:12:03.915143Z'
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T18:12:10.504Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-4418'
references:
  - url: 'https://www.ibm.com/support/pages/node/7290183'
tags:
  - cve.org
ingestedAt: '2026-10-19T18:35:50.145Z'
---

## Overview

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

## Affected

- `cloud_pak_system 2.3.6.0`
- `cloud_pak_system 2.3.6.1`

## Remediation

IBM strongly recommends addressing the vulnerability now by  https://www.ibm.com/support/pages/node/7284365 











For unsupported versions the recommendation is  to upgrade to supported version of the product.