CVE-2026-81859— Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
Quick assessment
Affected
IBM Cloud Pak for Business Automation
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
CP4BA - IBM 企业记录管理器（Enterprise Records） 可能允许本地攻击者利用使用了已破坏或存在风险的加密算法这一缺陷，获取敏感信息。 --- 详细解释与专业术语说明： 1. CP4BA：这是 IBM 安全公告中的漏洞编号，通常对应某个具体的安全补丁或 CVE 编号。 2. IBM Enterprise Records：指 IBM 的“企业记录”产品（也可能指 IBM QRadar、IBM Mainframe 中的记录管理系统等具体模块，视上下文而定，此处直译为“IBM 企业记录”）。 3.
Possible ATT&CK Techniques 2 AI
T1557.001 · Name Resolution Poisoning and SMB Relay T1557 · Adversary-in-the-MiddleAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| IBM | Cloud Pak for Business Automation | 26.0.0≤ 26.0.0 Interim Fix 001 |
affected |
25.0.0≤ 25.0.0 Interim Fix 005 |
affected | ||
24.0.1≤ 24.0.1 Interim Fix 008 |
affected | ||
24.0.0≤ 24.0.0 Interim Fix 009 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81859
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
Source: CVE Program / CVE List V5
Vulnerability Description
CP4BA - IBM Enterprise Records could allow a local attacker to obtain sensitive information due to the use of a broken or risky cryptographic algorithm.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用已被攻破或存在风险的密码学算法
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| IBM | Cloud Pak for Business Automation | 26.0.0 ~ 26.0.0 Interim Fix 001 |
cpe:2.3:a:ibm:cloud_pak_for_business_automation:26.0.0:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-81859
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81859
请登录查看更多情报信息。
Same Patch Batch · IBM · 2026-09-04 · 64 CVEs total
| CVE-2026-18658 | 9.8 CRITICAL | IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed |
| CVE-2026-19274 | 9.6 CRITICAL | IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent con |
| CVE-2026-19298 | 8.8 HIGH | Langflow is vulnerable to remote code execution due to authorization policy bypass in the |
| CVE-2026-18486 | 8.8 HIGH | IBM ContextForge MCP Gateway is affected by credential disclosure and privilege escalation |
| CVE-2026-19305 | 8.6 HIGH | Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL val |
| CVE-2026-77822 | 8.2 HIGH | IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) vi |
| CVE-2026-19303 | 8.1 HIGH | Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalida |
| CVE-2026-18175 | 8.1 HIGH | IBM i is Affected By Improper Authorization and Authentication Vulnerabilities in DDM / DR |
| CVE-2026-18221 | 8.1 HIGH | IBM i is Affected By Improper Authorization and Authentication Vulnerabilities in DDM / DR |
| CVE-2026-19283 | 7.7 HIGH | IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent con |
| CVE-2026-19306 | 7.7 HIGH | Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bu |
| CVE-2026-19304 | 7.7 HIGH | Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL val |
| CVE-2026-18905 | 7.7 HIGH | IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at |
| CVE-2026-81832 | 7.7 HIGH | IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable t |
| CVE-2026-19300 | 7.5 HIGH | Langflow is vulnerable to information disclosure due to cross-user MCP tool cache collisio |
| CVE-2026-18489 | 7.4 HIGH | IBM ContextForge Translate is affected by cross-client credential context confusion |
| CVE-2026-5522 | 6.7 MEDIUM | QRadar contains hard-coded credentials |
| CVE-2026-18887 | 6.5 MEDIUM | IBM i is Affected By Sensitive Information Exposure Vulnerability in PASE [] |
| CVE-2026-9186 | 6.5 MEDIUM | Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized M |
| CVE-2026-17622 | 6.5 MEDIUM | Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in f |
Showing top 20 of 64 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Cloud Pak for Business Automation
-
CVE-2026-12762
Insertion of Sensitive Information into Externally-Accessibl -
CVE-2025-36094
Multiple security vulnerabilities are addressed with IBM Clo -
CVE-2025-36436
Multiple security vulnerabilities are addressed with IBM Clo -
CVE-2025-36172
Multiple security vulnerabilities are addressed with IBM Clo -
CVE-2025-36093
security vulnerabilities are addressed with IBM Business Aut
Same vendor: IBM
-
CVE-2026-13297
Security vulnerabilities have been addressed in IBM Verify I -
CVE-2026-14350
Vulnerabilities exists in IBM Cloud Pak for Data System -
CVE-2026-14470
Langflow OSS is affected by arbitrary file read due to path -
CVE-2026-16180
IBM App Connect Enterprise and IBM Integration Bus for z/OS -
CVE-2026-16660
IBM Db2 Mirror for i is affected by multiple vulnerabilities
Same weakness: CWE-327
-
CVE-2026-16693
IBM i is Affected By Cryptographic Algorithm Weakness in DCM -
CVE-2026-76133
Ebyte NA111-M Use of a Broken or Risky Cryptographic Algorit -
CVE-2026-39944
Ceph: CephX AES Authentication error -
CVE-2025-30156
Ceph: AES-CBC misuse in CephX and RADOSGW enables authentica -
CVE-2026-77151
lin-snow Ech0 crypto.go MD5Encrypt risky encryption
V. Comments for CVE-2026-81859
No comments yet