IBM Security Bulletin: CVE-2026-13463 Hardcoded Credentials in IBM Cloud Pak System

IBM Security Bulletin: IBM Cloud Pak System is Affected by Vulnerability [CVE-2026-13463] Due to Use of IBM Storage Protect Vulnerability Overview CVE Number: CVE-2026-13463 Description: IBM Storage Protect allows local attackers to obtain sensitive information by injecting credentials into log files. CWE: CWE-798: Use of Hard-coded Credentials CVSS Score: 7.5 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Impact Scope Affected Products: IBM Cloud Pak System Affected Versions: 2.3.5.0 Remediation Recommended Fix: Upgrade to version 2.3.5.1 Applicable Products: IBM Cloud Pak System, IBM Cloud Pak System Software, IBM Cloud Pak System Software Suite Upgrade Information: https://www.ibm.com/support/pages/node/7274228 Unsupported Versions: It is recommended to upgrade to supported product versions. Additional Information Workarounds and Mitigations: None Notification of Future Security Bulletins: Subscribe to My Notifications to receive important product support alerts. Reference Links: - Complete CVSS v3 Guide - Online Calculator v3 Related Information: - IBM Secure Engineering Web Portal - IBM Product Security Incident Response Blog Acknowledgements: None Change History: - September 7, 2026: Initial release Disclaimer: According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard" intended to convey vulnerability severity and help determine response urgency and priority. IBM provides CVSS scores "as IS" without any express or implied warranties, including those of merchantability and fitness for a particular purpose. Customers are responsible for evaluating the impact of any actual or potential security vulnerabilities. IBM regularly updates records of components within its product portfolio to address potential vulnerabilities. As part of this effort, if IBM identifies previously unrecognized packages in the product/service list, the associated vulnerabilities will be addressed regardless of the CVE date. The inclusion of an older CVEID does not indicate that the product has been in use by IBM since that date, nor does it indicate that IBM was aware of the vulnerability at that time. We make customers aware of relevant vulnerabilities as we become aware of them. The IBM Security Bulletins cited in "Affected products and versions" are intended to cover only IBM-supported, non-expired products and versions. Therefore, citing products and versions that are unsupported or past end-support in this security bulletin does not constitute an IBM determination that they are unaffected by the vulnerability. Citing one or more unsupported versions in this security bulletin does not impose an obligation on IBM to fix any unsupported or expired product or versions. Cross-Reference Information

Goal Reached Thanks to every supporter — we hit 100%!

IBM Security Bulletin: CVE-2026-13463 Hardcoded Credentials in IBM Cloud Pak System

More from this source