CVE-2026-12751 is an HTML injection vulnerability in IBM Cloud Pak for Business Automation that allows remote attackers to inject malicious HTML code. When a victim views the injected content, the code executes in their browser under the security context of the affected site. This improper neutralization of script-related HTML tags corresponds to CWE-80. The vulnerability affects specific versions: 24.0.0, 24.0.1, 25.0.0, and 26.0.0. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires low privileges and user interaction, with a scope change and impacts on confidentiality and integrity but not availability.

Successful exploitation could allow an attacker to execute malicious HTML/JavaScript in the context of the affected web application, potentially leading to information disclosure and integrity violations. There is no indication of availability impact. The vulnerability requires user interaction and low privileges but can be triggered remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor IBM advisories for updates. Until a fix is available, consider applying any recommended workarounds from IBM and limit exposure by restricting access to affected versions where feasible.