IBM Cloud Pak for Business Automation versions 24.0.0 through 26.0.0, including certain interim fixes, are affected by an XPath injection vulnerability (CWE-643). This vulnerability allows an authenticated attacker to manipulate XPath queries improperly neutralized within the application, potentially leading to unauthorized disclosure of sensitive data or revealing XML document structure. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact without integrity or availability impact.

An authenticated attacker exploiting this vulnerability could exfiltrate sensitive application data or determine the structure of XML documents. There is no indication of impact on data integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or fix information is provided, users should monitor IBM's official security advisories for updates and apply any forthcoming patches promptly. Until a fix is available, restrict access to trusted authenticated users only and consider additional monitoring of application behavior related to XPath queries.