Medium severity · published Oct 19, 2026
CVE-2026-3161
IBM Cloud Pak System Risky Cryptographic Algorithm
5.9
CVSS
0.2%
EPSS
No
On KEV
Description
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
Cloud Pak System · IBM
2.3.6.0; 2.3.6.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3161
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3161
www.ibm.com
https://www.ibm.com/support/pages/node/7290183
More from Cloud Pak System
9.8
CVE-2019-4521
Platform System Manager in IBM Cloud Pak System 2.3 is potentially vulnerable to CVS Injection
8.8
CVE-2020-4917
IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the…
8.8
CVE-2019-4130
IBM Cloud Pak System 2.3 and 2.3.0.1 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server
7.5
CVE-2026-13463
Due to use of IBM Storage Protect, IBM Cloud Pak System is affected by vulnerability []
7.5
CVE-2023-38010
IBM Cloud Pak System displays sensitive information in user messages that could aid in further attacks against the system