Fix Readme
Abstract
The following document is for IBM Cloud Pak for Business Automation 26.0.0 IF004. It includes the CASE package download, installation information, and the list of APARs/Known Issues that are resolved in this interim fix.
Content
| Readme file for: | IBM Cloud Pak® for Business Automation |
|---|---|
| Product Release: | 26.0.0 |
| Update Name: | 26.0.0 IF004 |
| Fix ID: | 26.0.0-WS-CP4BA-IF004 |
| Publication Date: | 29 October 2026 |
Contents
Components impacted
Before upgrade
Installing the interim fix
Performing the necessary tasks after installation
Uninstalling
List of fixes
Known Limitations
Document change history
Prerequisites and supersedes
- Supersedes all prior interim fixes for Cloud Pak for Business Automation 26.0.0.
Components impacted
- General
- Cloud Pak for Business Automation Operator
- Automation Document Processing
- Automation Decision Services
- Business Automation Application
- Business Automation Insights
- Business Automation Navigator
- Business Automation Studio
- Business Automation Workflow including Automation Workstream Services
- Enterprise Records
- FileNet Content Manager
- Operational Decision Manager
- User Management Service
- Workflow Process Service
Before upgrade
- Ensure you take regular backups of any databases associated with the environment. For backup instructions, see Backing up your environment
- Ensure your operators are in a healthy state, before upgrading.
If one or more operators are failing, then it can prevent the system from completing an upgrade.
It is recommended to check a few of the important CR statuses to ensure there are not failures and the statuses appear ready for the various installed components. Check the status of the following CRs when they exist: oc get icp4acluster -o yaml oc get content -o yaml oc get Foundation -o yaml- Remove any image settings in CRs
If you used any individual image tag settings in your CRs, it could prevent the operator from updating the images to the appropriate version. Ensure you remove any of these settings when you upgrade. This doesn't apply to starter installation as it requires a new install.
Installing the interim fix
- Cloud Pak for Business Automation 26.0.0-IF004
- Cloud Pak Foundational Services 4.19.4
Download the 26.0.0-IF004 branch by using the following
git clonecommand.git clone -b 26.0.0-IF004 https://github.com/icp4a/cert-kubernetes.git
For an upgrade scenario, these are the Cloud Pak foundational services migration modes supported -
| Migration Mode | Support |
|---|---|
| Cluster-scoped to Namespace-scoped | Supported (This is the recommended approach if your current deployment is using cluster-scoped CPFs) |
| Namespace-scoped to Namespace-scoped | Supported (If your CPFs deployment is already namespace-scoped, then continue to remain at namespace-scoped) |
| Cluster-scoped to Cluster-scoped | Not Supported (Please follow the recommended upgrade from Cluster-scoped to Namespace-scoped for CPFs) |
| Cluster-scoped ("All namespaces") to Cluster-scoped ("All namespaces") | Supported ( There is no migration path from Cluster-scoped ("All namespaces") to Namespace-scoped ) |
Note: The recommended migration mode for an instance with cluster scoped Cloud Pak foundational services is to namespace scoped Cloud Pak foundational services.
- Scenario 1: You are installing a Starter deployment online or have an existing online Starter deploymentWarning: If you have an existing Cloud Pak Foundation Services instance installed at the cluster scoped level or in the namespace where CP4BA is being installed, then it is not supported. The Starter deployment of CP4BA is only supported when deploying into a new namespace without CPFs.
Actions: Starter deployments do not support upgrades; however, you can use this interim fix content to perform a Starter deployment. To deploy a Starter deployment using the content of this interim fix, please see install a new Starter environment and use the installation scripts from the branch that you cloned above. - Scenario 2: You are installing online Production deployment
Warning: If you have an existing Cloud Pak Foundation Services instance installed at the cluster scoped level or in the namespace where CP4BA is being installed, then it is not supported. The Production deployment of CP4BA is only supported when deploying into a new namespace without CPFs.Actions: To deploy an online Production deployment without using a local registry, please follow steps in install a new online Production environment and use the installation scripts from the branch that you cloned above. - Scenario 3: You are installing offline/airgap Production deploymentWarning: If you have an existing Cloud Pak Foundation Services instance installed at the cluster scoped level or in the namespace where CP4BA is being installed, then it is not supported. The Production deployment of CP4BA is only supported when deploying into a new namespace without CPFs.Note: As prerequisites for this scenario, you must follow steps here to set up the bastion host to mirror images to the registry and further to set up the private registry. The mirroring of images can be completed using "oc mirror" for the mirroring images process. If you are looking to install only a set of capabilities then you can make use of filters listed in Table 1 so that you can only download the specific set of images that you require.Actions:
To deploy an airgap/offline Production deployment, find mirror file cp4ba-case-to-be-mirrored-26.0.0-IF004.txt for this interim fix from the branch that you cloned above under the scripts/airgap directory. Execute this command from your bastion host to download the CASE files.
oc ibm-pak get -c file://(absolute path to file)/cp4ba-case-to-be-mirrored-26.0.0-IF004.txtThe absolute path to file needs to be a path starting from "/". For example, "/opt".
You will need to mirror the images associated with the new cp4ba-case-to-be-mirrored-26.0.0-IF004.txt mirror file.
export CASE_NAME=ibm-cp-automation export CASE_VERSION=26.0.4 export CASE_INVENTORY_SETUP=cp4aOperatorSetup export TARGET_REGISTRY=<target-registry> export NAMESPACE=<cp4ba_namespace_name>Follow the instructions for either mirroring option in Mirroring images to the private registry using the new CASE version associated with this interim fix.
Login to the cluster and go to namespace for the operator from the bastion host.
oc login https://<CLUSTERIP>:<port> -u <ADMINISTRATOR> oc project ${NAMESPACE}- From your bastion host, install the catalog sources and operators using the steps listed in Install Catalog Source and Operators using cluster admin script.
- Follow the remaining steps from Question 6 listed here to complete the installations of offline/airgap Production deployment.
- Scenario 4: Your installed Production deployment version is 24.0.0-IF009 or newer
Warning:
If your production deployment version is older than 24.0.0-IF009, please follow instructions in Knowledge Center to upgrade to 24.0.0-IF009 first and follow the below instructions to upgrade from 24.0.0-IF009 to this 26.0.0-IFix.
Actions:
For online upgrade, follow the upgrade instructions documented in Upgrading from 24.0.0.
For offline upgrade, you must first complete the prerequisites by following steps here to set up the bastion host to mirror images to the registry and further to set up the private registry. The mirroring of images can be completed using "oc mirror" for the mirroring images process manually or using"oc mirror" for the mirroring images process by script . Once the mirroring of images is completed, follow the upgrade instructions documented in Upgrading from 24.0.0. - Scenario 5: Your installed Production deployment version is 24.0.1 IF004 or newer
Warning:
If your production deployment version is older than 24.0.1-IF004, please follow instructions in Knowledge Center to upgrade to 24.0.1-IF004 first and follow the same instructions to upgrade from 24.0.1-IF002 to 25.0.0-IF004 or later. Then follow Scenario 6 to upgrade to this 26.0.0 IFix.
Actions:
Please follow the instructions and upgraded to 25.0.0-IF004 then follow instructions in Scenario 6 to upgrade to 26.0.0 IFix. - Scenario 6: Your installed Production deployment version is 25.0.0 IF004 or newer
Warning:
If your production deployment version is older than 25.0.0-IF004, please follow instructions in Knowledge Center to upgrade to 25.0.0-IF004 first and follow the below instructions to upgrade from 25.0.0-IF004 to this 26.0.0-IFix.
Actions:
For online upgrade, follow the upgrade instructions documented in Upgrading from 25.0.0.
For offline upgrade, you must first complete the prerequisites by following steps here to set up the bastion host to mirror images to the registry and further to set up the private registry. The mirroring of images can be completed using "oc mirror" for the mirroring images process manually or using"oc mirror" for the mirroring images process by script . Once the mirroring of images is completed, follow the upgrade instructions documented in Upgrading from 25.0.0. - Scenario 7: Your installed Production deployment version is 25.0.1 IF001
Warning:
If your production deployment version is older than 25.0.1-IF001, please follow instructions in Knowledge Center to upgrade to 25.0.1-IF001 first and follow the below instructions to upgrade from 25.0.1-IF001 to this 26.0.0-IFix.
Actions:
For online upgrade, follow the upgrade instructions documented in Upgrading from 25.0.1.
For offline upgrade, you must first complete the prerequisites by following steps here to set up the bastion host to mirror images to the registry and further to set up the private registry. The mirroring of images can be completed using "oc mirror" for the mirroring images process manually or using"oc mirror" for the mirroring images process by script . Once the mirroring of images is completed, follow the upgrade instructions documented in Upgrading from 25.0.1. - Scenario 8: Your installed Production deployment is 26.0.0 GA or newer.
Warning:
For a CP4BA Deployment with BAI ( Business Automation Insights ) selected as an optional component, it is recommended to create BAI savepoints before starting the upgrade process to this interim fix. For Flink event processing to resume from its previous state, savepoints are required to be created before the upgrade and specified in the updated CR. BAI savepoints can be created by following the below steps.Retrieve the name of the InsightsEngine custom resource file.
InsightsEngine_CR=$(kubectl get InsightsEngine --no-headers --ignore-not-found -n <CP4BA-Namespace> -o name)Retrieve and export the below details.export MANAGEMENT_URL=$(kubectl get ${InsightsEngine_CR} --no-headers --ignore-not-found -n <CP4BA Namespace> -o jsonpath='{.status.components.management.endpoints[?(@.scope=="External")].uri}') export MANAGEMENT_AUTH_SECRET=$(kubectl get ${InsightsEngine_CR} --no-headers --ignore-not-found -n <CP4BA Namespace> -o jsonpath='{.status.components.management.endpoints[?(@.scope=="External")].authentication.secret.secretName}') export MANAGEMENT_USERNAME=$(kubectl get secret ${MANAGEMENT_AUTH_SECRET} --no-headers --ignore-not-found -n <CP4BA Namespace> -o jsonpath='{.data.username}' | base64 -d) export MANAGEMENT_PASSWORD=$(kubectl get secret ${MANAGEMENT_AUTH_SECRET} --no-headers --ignore-not-found -n <CP4BA Namespace> -o jsonpath='{.data.password}' | base64 -d)Create BAI savepoints and store them in a temporary file called bai.json.
curl -X POST -k -u ${MANAGEMENT_USERNAME}:${MANAGEMENT_PASSWORD} "${MANAGEMENT_URL}/api/v1/processing/jobs/savepoints" -o ./bai.jsonScale down the CP4BA and Insights Engine Operator.
oc scale --replicas=0 deployment ibm-cp4a-operator oc scale --replicas=0 deployment ibm-insights-engine-operatorRetrieve the recovery path locations for each BAI component for which BAI savepoints are created from ./bai.json and update the bai_configuration section of the custom resource file. For Example: If there is a BAI savepoint being created for navigator component, then the updated custom resource file should have the below configuration.
bai_configuration: navigator: recovery_path: /mnt/pv/savepoints/dba/bai-navigator/savepoint-fb88f4-42027046b73b ... # Add recovery_path for all other components- Once the upgrade has been completed, make sure to remove all instances of the recovery_path parameters from the updated custom resource file.
Actions:
From the branch that you cloned above navigate to the scripts directory and perform the following steps to upgrade the CP4BA operators and deployment.Upgrade the CP4BA operators.
Actions:
Run the cp4a-deployment.sh script with the upgradeOperator option to upgrade the IBM Cloud Pak foundational services/CP4BA operators:./scripts/cp4a-deployment.sh -m upgradeOperator -n <CP4BA Namespace>Wait for the operators to complete their upgrades.
By default all subscriptions are set to automatic, but if you have any subscriptions set to manual then you need to approve any pending InstallPlans.
Use the below command to see the current status of the install plans.oc get installPlanThe upgrade will be blocked, if any of the needed InstallPlans are not approved. It is not recommended to set subscriptions to manual as this makes the upgrade more error prone.
You can use the following scripts to check the status of the upgrades.
Actions:
[OPTIONAL] Run the cp4a-deployment.sh script with upgradeOperatorStatus option to check that the upgrade of the CP4BA operator and its dependencies is successful:./scripts/cp4a-deployment.sh -m upgradeOperatorStatus -n <CP4BA Namespace>Run the cp4a-deployment.sh script with upgradeDeploymentStatus option to check that the upgrade of the CP4BA deployment is successful:
./scripts/cp4a-deployment.sh -m upgradeDeploymentStatus -n <CP4BA Namespace>
- Scenario 9: Your installed Production deployment is 26.0.0 GA or newer and using airgap/offline.
Note:
As prerequisites for this scenario, you must follow steps here to set up the bastion host to mirror images to the registry and further to set up the private registry.
Warning:
For a CP4BA Deployment with BAI ( Business Automation Insights ) selected as an optional component, it is recommended to create BAI savepoints before starting the upgrade process to this interim fix. For Flink event processing to resume from its previous state, savepoints are required to be created before the upgrade and specified in the updated CR. BAI savepoints can be created by following the below steps.Retrieve the name of the InsightsEngine custom resource file.
InsightsEngine_CR=$(kubectl get InsightsEngine --no-headers --ignore-not-found -n <CP4BA-Namespace> -o name)Retrieve and export the below details.export MANAGEMENT_URL=$(kubectl get ${InsightsEngine_CR} --no-headers --ignore-not-found -n <CP4BA Namespace> -o jsonpath='{.status.components.management.endpoints[?(@.scope=="External")].uri}') export MANAGEMENT_AUTH_SECRET=$(kubectl get ${InsightsEngine_CR} --no-headers --ignore-not-found -n <CP4BA Namespace> -o jsonpath='{.status.components.management.endpoints[?(@.scope=="External")].authentication.secret.secretName}') export MANAGEMENT_USERNAME=$(kubectl get secret ${MANAGEMENT_AUTH_SECRET} --no-headers --ignore-not-found -n <CP4BA Namespace> -o jsonpath='{.data.username}' | base64 -d) export MANAGEMENT_PASSWORD=$(kubectl get secret ${MANAGEMENT_AUTH_SECRET} --no-headers --ignore-not-found -n <CP4BA Namespace> -o jsonpath='{.data.password}' | base64 -d)Create BAI savepoints and store them in a temporary file called bai.json.
curl -X POST -k -u ${MANAGEMENT_USERNAME}:${MANAGEMENT_PASSWORD} "${MANAGEMENT_URL}/api/v1/processing/jobs/savepoints" -o ./bai.jsonScale down the CP4BA and Insights Engine Operator.
oc scale --replicas=0 deployment ibm-cp4a-operator oc scale --replicas=0 deployment ibm-insights-engine-operatorRetrieve the recovery path locations for each BAI component for which BAI savepoints are created from ./bai.json and update the bai_configuration section of the custom resource file. For Example: If there is a BAI savepoint being created for navigator component, then the updated custom resource file should have the below configuration.
bai_configuration: navigator: recovery_path: /mnt/pv/savepoints/dba/bai-navigator/savepoint-fb88f4-42027046b73b ... # Add recovery_path for all other components- Once the upgrade has been completed, make sure to remove all instances of the recovery_path parameters from the updated custom resource file.
Actions:
Perform the following steps and then the upgrade of operators and deployments will start.To upgrade an airgap/offline Production deployment, find mirror file cp4ba-case-to-be-mirrored-26.0.0-IF004.txt for this interim fix from the branch that you cloned above under the scripts/airgap directory. Execute this command from your bastion host to download the CASE files:
oc ibm-pak get -c file://(absolute path to file)/cp4ba-case-to-be-mirrored-26.0.0-IF004.txtThe (absolute path to file) needs to be a path starting from "/". For example, "/opt".
You will need to mirror the images associated with the new cp4ba-case-to-be-mirrored-26.0.0-IF004.txt mirror file.
export CASE_NAME=ibm-cp-automation export CASE_VERSION=26.0.4 export CASE_INVENTORY_SETUP=cp4aOperatorSetup export TARGET_REGISTRY=<target-registry> export NAMESPACE=<cp4ba_namespace_name>Follow the instructions for either mirroring option in Mirroring images to the private registry using the new CASE version associated with this interim fix. If you are looking to install only a set of capabilities then you can make use of filters listed in Table 1 so that you can only download the specific set of images that you require.
- From the branch that you cloned above navigate to the scripts directory and perform the following steps to upgrade the CP4BA operators.
Actions:
Run the cp4a-deployment.sh script with the upgradeOperator option to upgrade the IBM Cloud Pak foundational services/CP4BA operators:
./scripts/cp4a-deployment.sh -m upgradeOperator -n <CP4BA Namespace> Wait for the operators to complete their upgrades.
By default all subscriptions are set to automatic, but if you have any subscriptions set to manual then you need to approve any pending InstallPlans.
Use the below command to see the current status of the install plans.oc get installPlanThe upgrade will be blocked, if any of the needed InstallPlans are not approved. It is not recommended to set subscriptions to manual as this makes the upgrade more error prone.
You can use the following scripts to check the status of the upgrades.
Actions:
[OPTIONAL] Run the cp4a-deployment.sh script with upgradeOperatorStatus option to check that the upgrade of the CP4BA operator and its dependencies is successful:./scripts/cp4a-deployment.sh -m upgradeOperatorStatus -n <CP4BA Namespace>Run the cp4a-deployment.sh script with upgradeDeploymentStatus option to check that the upgrade of the CP4BA deployment is successful:
./scripts/cp4a-deployment.sh -m upgradeDeploymentStatus -n <CP4BA Namespace>
Performing the necessary tasks after installation
oc get icp4acluster icp4adeploy -o yaml > CP4BAconfig.yaml
oc logs deployment/ibm-cp4a-operator -c operator > operator.logibm-cp-automation\inventory\cp4aOperatorSdk\resources.yaml file in the CASE package. This file has a listing of the images managed by the CP4BA operator and their expected digest for this particular interim fix level.
kubectl create secret generic ibm-odm-keystore-secret --from-literal=keystorePassword="<YOUR_PASSWORD>" --namespace <PROJECT_NAME>ibm-odm-keystore-secret. Unless it is manually changed, it is linked to the CR instance generated by the deployment script:odm_configuration:
dba:
passwordSecretRef: ibm-odm-keystore-secret
Uninstalling
List of Fixes
| Column title | Column description |
| APAR/Known Issue | The defect number |
| Title | A short description of the defect |
| Sec. | A mark indicates a defect related to security |
| Cont. | A mark indicates a defect specific to the Cloud Pak integration of the component |
| B.I. | A mark indicates the fix has a business impact. Details are found in the title column or the APAR/Known Issue document |
- General
- Cloud Pak for Business Automation Operator
- Automation Document Processing
- Automation Decision Services
- Business Automation Application
- Business Automation Insights
- Business Automation Navigator
- Business Automation Studio
- Business Automation Workflow including Automation Workstream Services
- Enterprise Records
- FileNet Content Manager
- Operational Decision Manager
- User Management Service
- Workflow Process Service
| Known Issue | Title | Sec. | Cont. | B.I. |
|---|---|---|---|---|
| N/A | Cloud Pak for Business Automation delivers container images that include operating system level and other open source libraries. Vulnerabilities (CVEs) for these libraries are published regularly. This interim fix includes fixes for these libraries to address: CVE List Coming Soon
Previous interim fixes have included fixes which are also addressed with this interim fix. Consult the Related links section for readmes of previous interim fixes, at the bottom of this document. | X | ||
| N/A | In addition to the list above and those related to a Known Issue listed in the following tables this interim fix addresses applicable vulnerabilities listed in Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for October 2026 | X |
| Known Issue | Title | Sec. | Cont. | B.I. |
|---|---|---|---|---|
| DT502929 | WebSphere Application Server - Liberty is affected by multiple vulnerabilities (CVE-2026-93895, CVE-2026-95695, CVE-2026-95696) | X | ||
| DT502467 | IBM WebSphere Application Server Liberty is affected by a deserialization of untrusted data (CVE-2026-93905) | X | ||
| DT502944 | IBM WebSphere Application Server Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption (CVE-2026-103499) | X | ||
| DT501739 | WebSphere Application Server Liberty is affected by a XML External Entity due to RestEasy (CVE-2026-17615) | X | ||
| DT503153 | WebSphere Application Server - Liberty is affected by multiple vulnerabilities (CVE-2026-6853 and CVE-2026-76646) | X | ||
| DT502359 | IBM WebSphere Application Server Liberty is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled (CVE-2026-93909) | X | ||
| DT503516 | IBM WebSphere Application Server Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service (CVE-2026-105442) | X | ||
| DT503659 | IBM WebSphere Application Server Liberty has insufficient isolation between servers sharing an install (CVE-2026-105443) | X | ||
| DT503710 | IBM WebSphere Application Server Liberty is affected by an uncontrolled resource consumption due to js-yaml (CVE-2026-84375 7.5) | X | ||
| DT502997 | IBM WebSphere Application Server Liberty is affected by cryptographic signature verification bypass (CVE-2026-101294 CVSS 8.7) | X |
| Known Issue | Title | Sec. | Cont. | B.I. |
|---|---|---|---|---|
| Please see Business Automation Navigator Fix List APARs for Cloud Pak for Business Automation technote |
| Known Issue | Title | Sec. | Cont. | B.I. |
|---|---|---|---|---|
| DT501088 | A REST service will fail if a parameter contains curly braces | |||
| DT504056 | CWTBG0632E error seen when managing access permissions in Workflow Center while assigning groups |
| Known Issue | Title | Sec. | Cont. | B.I. |
|---|---|---|---|---|
| DT501088 | A REST service will fail if a parameter contains curly braces | |||
| DT504056 | CWTBG0632E error seen when managing access permissions in Workflow Center while assigning groups |
| APAR | Title | Sec. | Cont. | B.I. |
|---|---|---|---|---|
| See FileNet Content Manager Release Fix List APARs for IBM Cloud Pak for Business Automation technote |
| Known Issue | Title | Sec. | Cont. | B.I. |
|---|---|---|---|---|
| DT504153 | MEMORY LEAK WHEN ENABLING A RES EXECUTION TRACE | |||
| DT501743 | PERFORMANCE ISSUE DURING ACTIVITY CREATION | |||
| DT503759 | ZENEXTENSION AUTOMATICALLY RECREATED | |||
| DT500227 | RULESET STATISTICS SLOW IN RES CONSOLE WITH MANY EXECUTION UNITS | |||
| DT502917 | DECISIONCENTERSETUPSERVICE SHOULD NOT ACQUIRE DBLOCK IF DB-SCHEMA IS ALREADY AVAILABLE | |||
| DT501097 | ACTIVITYSTREAMHELPER.SUBSCRIPTIONTOASOBJECT LOGS SPURIOUS INFO MESSAGES THAT CAN FLOOD LOG FILES ON LARGE DECISION SERVICES WITH MANY USERS | |||
| DT502322 | DECISION CENTER DEPLOY TO RES DOES NOT ENFORCE DUPLICATE RULEFLOW NAME VALIDATION | |||
| DT503005 | Z/OS C PROGRAMS IGNORES TMPDIR — TEMP FILE ALWAYS WRITTEN TO SYSTEM /TMP |
| Known Issue | Title | Sec. | Cont. | B.I. |
|---|---|---|---|---|
| N/A | N/A |
| Known Issue | Title | Sec. | Cont. | B.I. |
|---|---|---|---|---|
| DT501088 | A REST service will fail if a parameter contains curly braces | |||
| DT504056 | CWTBG0632E error seen when managing access permissions in Workflow Center while assigning groups |
Known Limitations
Document change history
- 29 October 2026: Initial publish.
Related Information
[Supersedes 26.0.0-IF003] Readme for IBM Cloud Pak for Business Automation 26.0…
[Supersedes 26.0.0-IF002] Readme for IBM Cloud Pak for Business Automation 26.0…
[Supersedes 26.0.0-IF001] Readme for IBM Cloud Pak for Business Automation 26.0…
Fix list for Cloud Pak for Business Automation 26.0.0
Was this topic helpful?
Document Information
Modified date:
29 October 2026
UID
ibm17286024