CVE-2026-4418: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in IBM Cloud Pak System

CVE-2026-4418 is an HTML injection vulnerability in IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1. The flaw allows a remotely authenticated attacker with low privileges to inject malicious HTML code into the web interface. When a victim views the injected content, the malicious code executes within the security context of the hosting site, potentially leading to information disclosure or session manipulation. The vulnerability is categorized under CWE-80, indicating improper neutralization of script-related HTML tags in a web page. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, required privileges, and user interaction.

An attacker with remote authenticated access and low privileges can inject malicious HTML code that executes in the victim's browser under the hosting site's security context. This can lead to limited confidentiality and integrity impacts, such as theft of sensitive information or manipulation of user sessions. There is no impact on availability. No known exploits are reported in the wild.

No vendor advisory or patch information is provided for this vulnerability. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, limit exposure by restricting authenticated user privileges and monitoring for suspicious activity related to HTML injection attempts.