CVE-2026-3684: Vulnerabilities exists in IBM Cloud Pak for Data System
IBM Cloud Pak for Data System 11.3.1.2 Interim Fix 001 through - 11.3.1.2 Interim Fix 002 could allow a user with administrative privileges to read and write arbitrary files on the system due to incorrect permission assignments.
Other sources
IBM Cloud Pak for Data System could allow a user with administrative privileges to read and write arbitrary files on the system due to incorrect permission assignments.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Cloud Pak for Data System (Yosemite 1.0)to a version that resolves this vulnerability.Fixed in 11.3.1.2-IF3-WS-ICPDS-1x-NPS-fp367344Patch fp367344
Event History
Frequently Asked Questions
Which deployments are affected?
IBM Cloud Pak for Data System 11.3.1.2 Interim Fix 001 through 11.3.1.2 Interim Fix 002 are identified as affected.
What access does an attacker need to exploit this issue?
The attacker must already have administrative privileges on the IBM Cloud Pak for Data System. No user interaction is required.
What could an administrator do through this vulnerability?
An administrator could read and write arbitrary files on the system because of incorrect permission assignments. The issue affects confidentiality and integrity, but no availability impact is stated.