IBM Support

IBM Cloud Pak System Version 2.3.6.2

Download


Abstract

This document lists the fixes contained in IBM Cloud Pak® System Version 2.3.6.2.

Download Description

To download Version 2.3.6.2, go to the IBM Cloud Pak System product page on IBM Fix Central.

Security vulnerabilities

IBM Cloud Pak System Version 2.3.6.2 includes fixes for these security vulnerabilities:

Relevant vulnerabilities

Summary

Security Bulletin URL

CVE-2023-38375CPS Cross-site scripting (reflected)https://www.ibm.com/support/pages/node/7290183
CVE-2024-43799send-0.18.0.tgz (Publicly disclosed vulnerability found by Mend)https://www.ibm.com/support/pages/node/7239408
CVE-2024-12801, CVE-2024-12798logback-core-1.2.3.jar (Publicly disclosed vulnerability found by Mend)https://www.ibm.com/support/pages/node/7246870
CVE-2025-55163, CVE-2021-4264, CVE-2025-53864, CVE-2025-48924, CVE-2024-6484, CVE-2024-13009, CVE-2021-23445Multiple vulnerabilities in Storage Scalehttps://www.ibm.com/support/pages/node/7277074
CVE-2024-47072, CVE-2025-36442, CVE-2025-36428, CVE-2025-36427, CVE-2025-36407, CVE-2025-36387, CVE-2025-36366, CVE-2025-36365, CVE-2025-58056, CVE-2025-58057, CVE-2025-55163, CVE-2025-36353, CVE-2025-36098, CVE-2025-36123, CVE-2025-36070, CVE-2025-36009, CVE-2025-36001, CVE-2025-36184, CVE-2025-2668DB2 is affected by multiple vulnerabilities (January 2026)https://www.ibm.com/support/pages/node/7275595
CVE-2025-47913golang.org/x/crypto-v0.38.0 (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7276786
CVE-2025-47914, CVE-2025-58181golang.org/x/crypto-v0.38.0 (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7276786
CVE-2025-6493, CVE-2025-47914, CVE-2025-47913Multiple vulnerabilities in IBM Storage Scalehttps://www.ibm.com/support/pages/node/7277760
CVE-2025-33012, CVE-2025-33134, CVE-2025-2534, CVE-2024-47118, CVE-2025-36006, CVE-2025-36008, CVE-2025-36131, CVE-2025-36136DB2 is affected by multiple vulnerabilities (Nov 2025)https://www.ibm.com/support/pages/node/7275595
CVE-2025-12635WebSphere Application Server Liberty is affected by cross-site scriptinghttps://www.ibm.com/support/pages/node/7290184
CVE-2025-15284qs-6.13.0.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7282517
CVE-2025-59375expat 2.7.1 (Publicly disclosed vulnerability processed by Bulk Open)https://www.ibm.com/support/pages/node/
CVE-2025-55753, CVE-2025-58098, CVE-2025-65082, CVE-2025-66200httpd 2.4.65 (Publicly disclosed vulnerability processed by Bulk Open)https://www.ibm.com/support/pages/node/7277068
CVE-2025-5987libssh 0.10.4 (Publicly disclosed vulnerability processed by Bulk Open)https://www.ibm.com/support/pages/node/
CVE-2025-5372libssh 0.9.6 (Publicly disclosed vulnerability processed by Bulk Open)https://www.ibm.com/support/pages/node/
CVE-2025-9230openssl 1.1.1 (Publicly disclosed vulnerability processed by Bulk Open)https://www.ibm.com/support/pages/node/7277068
CVE-2026-22036undici-7.16.0.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7279929
CVE-2026-21945, CVE-2026-21933, CVE-2026-21925IBM SDK, Java Technology Edition Quarterly CPU - Jan 2026 - Includes Oracle January 2026 CPUhttps://www.ibm.com/support/pages/node/7276508
CVE-2025-13465lodash-4.17.21.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7277982
CVE-2026-1225logback-core-1.2.3.jar (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2025-61140jsonpath-1.1.1.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7282517
CVE-2025-15468, CVE-2025-15469, CVE-2025-66199, CVE-2025-68160, CVE-2025-69418, CVE-2025-69419, CVE-2025-69421, CVE-2026-22795, CVE-2026-22796Openssl Security updates as of Jan 28, 2026https://www.ibm.com/support/pages/node/7277068
CVE-2025-68157, CVE-2025-68458webpack-5.102.1.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-1615jsonpath-1.1.1.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7282517
CVE-2026-3161Cloud Pak System appliance found vulnerable to Deprecated Cryptographic Settings both in SSH and SHA1https://www.ibm.com/support/pages/node/7290183
CVE-2026-25639axios-1.12.2.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7277066
CVE-2025-69873ajv-6.12.6.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7277982
CVE-2026-2391qs-6.13.0.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7282517
CVE-2025-36247, CVE-2025-36425, CVE-2025-13867DB2 is affected by multiple vulnerabilities (February 2026)https://www.ibm.com/support/pages/node/7275595
CVE-2026-26996minimatch-3.1.2.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7290674
CVE-2026-3295Cloud Pak System vulnerable to Stored Cross-Site Scriptinghttps://www.ibm.com/support/pages/node/7290183
CVE-2025-14923WebSphere Application Server Liberty could provide weaker than expected securityhttps://www.ibm.com/support/pages/node/7277754
CVE-2026-27903, CVE-2026-27904minimatch-3.1.2.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7290676
CVE-2026-27606rollup-2.79.2.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7282517
CVE-2026-3449once-1.1.2.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-13463User credentials in PureCLI log filehttps://www.ibm.com/support/pages/node/7279434
CVE-2024-26308Vulnerable Version Of Software In Use in pureclihttps://www.ibm.com/support/pages/node/7276918
CVE-2026-29063immutable-5.1.3.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7277982
CVE-2026-29074svgo-2.8.0.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-4418HTML injectionhttps://www.ibm.com/support/pages/node/7290183
CVE-2026-32141flatted-3.3.3.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7277982
CVE-2026-1525, CVE-2026-1526, CVE-2026-1527, CVE-2026-1528, CVE-2026-2229undici-7.16.0.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7279929
WS-2026-0003jackson-core-2.14.0.jar (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-33228flatted-3.3.3.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7277982
CVE-2022-27775, CVE-2022-27776, CVE-2024-23556, CVE-2024-0853, CVE-2024-42200, CVE-2024-42189, CVE-2024-42193, CVE-2023-37520, CVE-2024-13176, CVE-2025-9086HCL BigFix Multiple Security Vulnerabilities updateshttps://www.ibm.com/support/pages/node/7276505
CVE-2026-1561WebSphere Application Server Liberty is affected by server-side request forgeryhttps://www.ibm.com/support/pages/node/7290184
CVE-2026-33671, CVE-2026-33672picomatch-2.3.1.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7282517
CVE-2025-62718, CVE-2026-40175axios-1.12.2.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7277066
CVE-2020-5258, CVE-2021-23450dojo-1.8.14.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2018-1000665dojo-1.9.2.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-4867path-to-regexp-0.1.12.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7282517
CVE-2025-36122, CVE-2025-14688, CVE-2025-67735, CVE-2025-68161, CVE-2025-12183, CVE-2026-1352, CVE-2026-1577DB2 is affected by multiple vulnerabilities (April 2026)https://www.ibm.com/support/pages/node/
CVE-2026-22016, CVE-2026-22021, CVE-2026-22013, CVE-2026-22018, CVE-2026-34268, CVE-2026-22007IBM SDK, Java Technology Edition Quarterly CPU - Apr 2026 - Includes Oracle April 2026 CPUhttps://www.ibm.com/support/pages/node/7276508
CVE-2026-40895follow-redirects-1.15.11.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-42033, CVE-2026-42034, CVE-2026-42035, CVE-2026-42036, CVE-2026-42037, CVE-2026-42038, CVE-2026-42039, CVE-2026-42040, CVE-2026-42041, CVE-2026-42042, CVE-2026-42043, CVE-2026-42044axios-1.12.2.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7277066
CVE-2026-33532yaml-2.8.1.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-6321fast-uri-3.1.0.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-24072, CVE-2026-34059, CVE-2026-34032, CVE-2026-23918, CVE-2026-33857, CVE-2026-29169, CVE-2026-33006, CVE-2026-33007, CVE-2026-33523Apache Addressed Multiple Vulnerabilities in Apache HTTP Server (4-May-2026)https://www.ibm.com/support/pages/node/7290243
CVE-2026-42264axios-1.12.2.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7277066
CVE-2026-41683, CVE-2026-41690, CVE-2026-42353i18next-http-middleware-3.8.1.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7289807
CVE-2025-66471, CVE-2025-66418, CVE-2026-21441urllib3-2.2.3-py3-none-any.whlhttps://www.ibm.com/support/pages/node/
CVE-2026-6322fast-uri-3.1.0.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-43284Dirty Frag vulnerabilities allow Local privilege escalation in Linux kernelshttps://www.ibm.com/support/pages/node/
CVE-2026-1718, CVE-2026-6053, CVE-2026-6052, CVE-2026-6051, CVE-2025-13755DB2 is affected by multiple vulnerabilities (May 2026)https://www.ibm.com/support/pages/node/
CVE-2026-33466Logstash Security Updates for Multiple Vulnerabilities (April 2026)https://www.ibm.com/support/pages/node/
CVE-2024-41073, CVE-2025-40252, CVE-2025-68724, CVE-2026-23401, CVE-2026-31402, CVE-2026-31431, CVE-2026-43077kernel 4.18.0-553.el8_10 (Publicly disclosed vulnerability processed by Bulk Open)https://www.ibm.com/support/pages/node/
CVE-2026-8723qs-6.13.0.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46597, CVE-2026-46598, CVE-2026-46595golang.org/x/crypto-v0.38.0 (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7279554
CVE-2026-44728plugin-transform-modules-systemjs-7.27.1.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-9277shell-quote-1.8.3.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2025-15467, CVE-2025-61984, CVE-2025-61985, CVE-2025-9231, CVE-2026-28387, CVE-2026-28388, CVE-2026-28389, CVE-2026-28390, CVE-2026-31789, CVE-2026-31790Multiple vulnerabilities in Apache Opensslhttps://www.ibm.com/support/pages/node/7277068
CVE-2021-46984, CVE-2021-47097, CVE-2021-47101, CVE-2021-47287, CVE-2021-47289, CVE-2021-47321, CVE-2021-47338, CVE-2021-47352, CVE-2021-47383, CVE-2021-47384, CVE-2021-47385, CVE-2021-47386, CVE-2021-47393, CVE-2021-47412, CVE-2021-47432, CVE-2021-47441, CVE-2021-47455, CVE-2021-47466, CVE-2021-47497, CVE-2021-47527, CVE-2021-47560, CVE-2021-47582, CVE-2021-47609, CVE-2022-48619, CVE-2022-48754, CVE-2022-48760, CVE-2022-48804, CVE-2022-48836, CVE-2022-48866, CVE-2022-49226, CVE-2022-49316, CVE-2022-50072, CVE-2023-52470, CVE-2023-52476, CVE-2023-52478, CVE-2023-52522, CVE-2023-52683, CVE-2023-52798, CVE-2023-52800, CVE-2023-52809, CVE-2023-52817, CVE-2023-52840, CVE-2023-52922, CVE-2023-53401, CVE-2023-53539, CVE-2023-53847, CVE-2023-54269, CVE-2023-6040, CVE-2024-23848, CVE-2024-26595, CVE-2024-26600, CVE-2024-26638, CVE-2024-26645, CVE-2024-26649, CVE-2024-26665, CVE-2024-26717, CVE-2024-26720, CVE-2024-26769, CVE-2024-26846, CVE-2024-26855, CVE-2024-26880, CVE-2024-26894, CVE-2024-26923, CVE-2024-26939, CVE-2024-27013, CVE-2024-27042, CVE-2024-35809, CVE-2024-35877, CVE-2024-35884, CVE-2024-35944, CVE-2024-35989, CVE-2024-36883, CVE-2024-36901, CVE-2024-36902, CVE-2024-36919, CVE-2024-36920, CVE-2024-36922, CVE-2024-36939, CVE-2024-36953, CVE-2024-37356, CVE-2024-38558, CVE-2024-38559, CVE-2024-38570, CVE-2024-38579, CVE-2024-38581, CVE-2024-38619, CVE-2024-39471, CVE-2024-39499, CVE-2024-39506, CVE-2024-40901, CVE-2024-40904, CVE-2024-40911, CVE-2024-40912, CVE-2024-40929, CVE-2024-40931, CVE-2024-40941, CVE-2024-40954, CVE-2024-40958, CVE-2024-40959, CVE-2024-40960, CVE-2024-40972, CVE-2024-40977, CVE-2024-40978, CVE-2024-40988, CVE-2024-40989, CVE-2024-40995, CVE-2024-40997, CVE-2024-40998, CVE-2024-41005, CVE-2024-41007, CVE-2024-41008, CVE-2024-41012, CVE-2024-41013, CVE-2024-41014, CVE-2024-41023, CVE-2024-41035, CVE-2024-41038, CVE-2024-41039, CVE-2024-41040, CVE-2024-41041, CVE-2024-41044, CVE-2024-41055, CVE-2024-41056, CVE-2024-41060, CVE-2024-41064, CVE-2024-41065, CVE-2024-41076, CVE-2024-41090, CVE-2024-41091, CVE-2024-41097, CVE-2024-42084, CVE-2024-42090, CVE-2024-42094, CVE-2024-42096, CVE-2024-42114, CVE-2024-42124, CVE-2024-42131, CVE-2024-42152, CVE-2024-42154, CVE-2024-42225, CVE-2024-42228, CVE-2024-42237, CVE-2024-42238, CVE-2024-42240, CVE-2024-42246, CVE-2024-42265, CVE-2024-42322, CVE-2024-43830, CVE-2024-43871, CVE-2024-45026kernel 4.18.0-553.el8_10 (Publicly disclosed vulnerability processed by Bulk Open)https://www.ibm.com/support/pages/node/7290255
CVE-2026-9828logback-core-1.3.4.jar (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-10532logback-core-1.3.4.jar (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-33750brace-expansion-1.1.12.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2025-68146, CVE-2026-22701filelock-3.16.1-py3-none-any.whl (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2025-12816, CVE-2025-66030, CVE-2025-66031, CVE-2026-33891, CVE-2026-33894, CVE-2026-33895, CVE-2026-33896node-forge-1.3.1.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7282517
CVE-2024-47081, CVE-2026-25645requests-2.32.3-py3-none-any.whl (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2025-50181, CVE-2025-50182, CVE-2026-44431urllib3-2.2.3-py3-none-any.whl (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-44495axios-1.12.2.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7279622
CVE-2026-12143form-data-3.0.4.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-48714i18next-http-middleware-3.8.1.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/7289807
CVE-2026-11525, CVE-2026-12151, CVE-2026-6733, CVE-2026-9678, CVE-2026-9679undici-7.16.0.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-48779ws-7.5.10.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-11541IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by HTTP request smugglinghttps://www.ibm.com/support/pages/node/7290184
CVE-2026-49356core-7.28.4.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-55602http-proxy-middleware-2.0.9.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-53550js-yaml-3.14.1.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-53632launch-editor-2.11.1.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-9320, CVE-2026-8646IBM WebSphere Application Server - Liberty is affected by HTTP request smuggling and a denial of service.https://www.ibm.com/support/pages/node/
CVE-2026-9071IBM WebSphere Application Server - Liberty is affected by HTTP request smuggling and a denial of service.https://www.ibm.com/support/pages/node/7290184
CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515jackson-databind-2.15.2.jar (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-13311shell-quote-1.8.3.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-13676fast-uri-3.1.0.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-50645, CVE-2026-9322, CVE-2026-9171IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilitieshttps://www.ibm.com/support/pages/node/7290184
CVE-2026-13149brace-expansion-1.1.12.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2024-4741, CVE-2026-45447rhel8 (openssl) - RHSA-2026:26275https://www.ibm.com/support/pages/node/
CVE-2026-44486, CVE-2026-44487, CVE-2026-44488, CVE-2026-44490, CVE-2026-44492, CVE-2026-44494, CVE-2026-44496Axios-12.2.2 vulnerabilities in cps236*https://www.ibm.com/support/pages/node/
CVE-2026-59879, CVE-2026-59880immutable-5.1.3.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-59869js-yaml-3.14.1.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-12590body-parser-1.20.3.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-59888jackson-databind-2.15.2.jar (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-59889jackson-databind-2.21.2.jar (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-49975CVE-2026-49975 -- HTTP2 Bombhttps://www.ibm.com/support/pages/node/7290243
CVE-2026-54466, CVE-2026-54490websocket-driver-0.7.4.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-7383, CVE-2026-34180, CVE-2026-42766, CVE-2026-42770, CVE-2026-42771Multiple security vulnerabilities for Openssl as per OpenSSL Advisory (Jun 2026)https://www.ibm.com/support/pages/node/
CVE-2026-41254, CVE-2026-47057, CVE-2026-47063, CVE-2026-47058, CVE-2026-60147, CVE-2026-46968, CVE-2026-47027, CVE-2026-47021, CVE-2026-47059, CVE-2026-47010, CVE-2026-8400, CVE-2026-16439, CVE-2026-16441, CVE-2026-16243IBM SDK, Java Technology Edition Quarterly CPU - Jul 2026 - Includes Oracle July 2026 CPU plus four additional vulnerabilitieshttps://www.ibm.com/support/pages/node/7290666
CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, CVE-2026-41703, CVE-2026-41709Multiple vulnerabilities found in VMWare ESXi, vCenter et alhttps://www.ibm.com/support/pages/node/7288405
CVE-2026-67313, CVE-2026-67312, CVE-2026-67316, CVE-2026-67317, CVE-2026-67319axios-1.12.2.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-29167, CVE-2026-29170, CVE-2026-44186, CVE-2026-34356, CVE-2026-42535, CVE-2026-43951, CVE-2026-44119, CVE-2026-44631Due to IBM Tivoli Monitoring, IBM Cloud PAk System is affectd by multiple security vulnerabilities in Apache Http Serverhttps://www.ibm.com/support/pages/node/
CVE-2026-18401, CVE-2026-68494jackson-core-2.15.2.jar (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-16480, CVE-2026-10543, CVE-2026-10534, CVE-2026-45205DB2 is affected by multiple vulnerabilities (August 2026)https://www.ibm.com/support/pages/node/
CVE-2026-73086nanoid-3.3.11.tgz (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-77310jackson-databind-2.15.2.jar (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/
CVE-2026-19032jackson-databind-2.15.2.jar (Publicly disclosed vulnerability found by Scanner)https://www.ibm.com/support/pages/node/

 

 

For more information about IBM Product Security articles, see these links:

IBM Cloud Pak System problem fixes


The following table contains the problem fixes that are included in this release.
Optional: If an integrated pattern or component is not listed, there were no fixes for that pattern or component in this version. The upgrade recommendation is to move directly to Version 2.3.6.2.

 

DocumentDescription
DT447822Deployment of new pattern IBM BAW 24.0.1 Workflow Server with DB2 HADR for Production 1.0.0.2 fails with less than 11 GB memory on custom node.
DT449523Add-Ons in pattern builder shows many older version when using the drop-down list.
DT454179Daily CWZIP1807W events raised, but no hardware issues are detected.
DT461071“View all workload resources” does not work as expected.
DT462379Adding authorizations to a VSI fails for a user.
DT462594CWZIP6239E The amount of free space on the file system /var/log is critical for Cloud Pak System.
DT464402The pattern deployment, which has multiple disks gets failed due to a huge number of jobs, which get triggered in iaas pool.
DT465425Adding a ports through Manage Console → Operations → Firewall does not take effect immediately.
DT465745Service 78 stuck online -CWZIP1200E Unable to communicate with the virtual management software using IP address (IPV6) on one of the PSM - SN#xxx
DT471442Missing /usr/bin/python after security updates.
DT495830Interim fixes to IBM Business Automation Workflow P-Type do not get applied when the fix version is in the format like 24.0.1.0-IF006. Fixes that are not in this particular format (like 24.0.1.0.IF001) can be applied.

 

 

 

 

 

Off
[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSFQSV","label":"IBM Cloud Pak System Software"},"ARM Category":[{"code":"a8m0z000000cwm2AAA","label":"Product Components"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"2.3.6"}]

Problems (APARS) fixed
DT447822; DT449523; DT454179; DT461071; DT462379; DT462594; DT464402; DT465425; DT465745; DT471442; DT495830

Document Information

Modified date:
05 October 2026

UID

ibm17285400

Page Feedback