CVE-2026-12751— Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
Quick assessment
Affected
IBM Cloud Pak for Business Automation
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
IBM Cloud Pak for Business Automation 存在 HTML 注入漏洞。远程攻击者可以注入恶意的 HTML 代码，当受害者查看该内容时，代码将在受害者的 Web 浏览器中执行，且运行于托管网站的安全上下文中。
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by CompromiseAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| IBM | Cloud Pak for Business Automation | 26.0.0≤ 26.0.0 Interim Fix 001 |
affected |
25.0.0≤ 25.0.0 Interim Fix 005 |
affected | ||
24.0.1≤ 24.0.1 Interim Fix 008 |
affected | ||
24.0.0≤ 24.0.0 Interim Fix 009 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-12751
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
Source: CVE Program / CVE List V5
Vulnerability Description
IBM Cloud Pak for Business Automation is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
Web页面中脚本相关HTML标签转义处理不恰当(基本跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| IBM | Cloud Pak for Business Automation | 26.0.0 ~ 26.0.0 Interim Fix 001 |
cpe:2.3:a:ibm:cloud_pak_for_business_automation:26.0.0:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-12751
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12751
请登录查看更多情报信息。
Same Patch Batch · IBM · 2026-09-15 · 25 CVEs total
| CVE-2026-53710 | 10.0 CRITICAL | MCP Context Forge: RestrictedPython sandbox bypass via getattr builtin in python_sandbox_s |
| CVE-2026-12351 | 9.8 CRITICAL | IBM MQ is vulnerable to unauthenticated remote code execution via JNDI injection |
| CVE-2026-12728 | 8.8 HIGH | IBM MQ Java messaging is vulnerable to remote code execution |
| CVE-2026-11729 | 8.5 HIGH | IBM MQ Java messaging is vulnerable to remote code execution |
| CVE-2026-12666 | 8.1 HIGH | IBM MQ Java messaging is vulnerable to XML external entity injection |
| CVE-2026-12355 | 8.1 HIGH | IBM MQ Resource Adapter IVT servlet is vulnerable to unauthenticated remote code execution |
| CVE-2026-11728 | 8.1 HIGH | IBM MQ .NET client is vulnerable to remote code execution |
| CVE-2026-12354 | 7.5 HIGH | IBM MQ Resource Adapter IVT message-driven bean is vulnerable to remote code execution via |
| CVE-2026-12667 | 7.1 HIGH | IBM MQ .NET client is vulnerable to XML external entity injection |
| CVE-2026-12752 | 7.1 HIGH | Multiple security vulnerabilities addressed with IBM Business Automation Workflow August 2 |
| CVE-2026-12150 | 7.0 HIGH | IBM MQ queue manager is vulnerable to denial of service |
| CVE-2026-11864 | 6.5 MEDIUM | Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation |
| CVE-2026-12749 | 6.4 MEDIUM | Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation |
| CVE-2026-12750 | 6.4 MEDIUM | Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation |
| CVE-2026-12742 | 5.4 MEDIUM | Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 202 |
| CVE-2026-11918 | 5.4 MEDIUM | IBM ContextForge MCP Gateway is affected by security filter bypass via nested payload stru |
| CVE-2026-11929 | Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Securit | |
| CVE-2026-11934 | Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Securit | |
| CVE-2026-12101 | Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Securit | |
| CVE-2026-11928 | Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Securit |
Showing top 20 of 25 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Cloud Pak for Business Automation
-
CVE-2026-11864
Multiple security vulnerabilities are addressed with IBM Clo -
CVE-2026-12749
Multiple security vulnerabilities are addressed with IBM Clo -
CVE-2026-12750
Multiple security vulnerabilities are addressed with IBM Clo -
CVE-2026-12758
Multiple security vulnerabilities are addressed with IBM Clo -
CVE-2026-12759
Multiple security vulnerabilities are addressed with IBM Clo
Same vendor: IBM
-
CVE-2026-11728
IBM MQ .NET client is vulnerable to remote code execution -
CVE-2026-11729
IBM MQ Java messaging is vulnerable to remote code execution -
CVE-2026-11864
Multiple security vulnerabilities are addressed with IBM Clo -
CVE-2026-11918
IBM ContextForge MCP Gateway is affected by security filter -
CVE-2026-11921
Security vulnerabilities have been addressed in IBM Verify I
Same weakness: CWE-80
-
CVE-2026-54503
plone.app.textfield: Stored XSS by spoofing mime type -
CVE-2026-52774
Reflected XSS via Unescaped `id` Parameter in Bazar Widget H -
CVE-2026-52773
Reflected XSS via Unescaped Archived-Revision `time` Paramet -
CVE-2026-32773
Apache Spark: XSS Vulnerability in Spark Web 3.5.4 -
CVE-2026-82838
Default webserver configuration with incorrect CSP
V. Comments for CVE-2026-12751
No comments yet