Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-12749
IBM Cloud Pak for Business Automation — Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L L R C L L N 5.4 .0016 5.2 —
AFFECTED
Product Versions Fixed
Cloud Pak for Business Automation 26.0.0 – —
TIMELINE
Jun 19 Reserved by ibm
Sep 15 Published (CNA: ibm)
Sep 23 RESCORED — CVE-2026-12749 (IBM Cloud Pak for Business Automation). CVSS 6.4 → 5.4 (NVD).
Description
IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| June 19, 2026 | Reserved | Reserved by ibm |
| September 15, 2026 | Published | Published (CNA: ibm) |
| September 23, 2026 | RESCORED | RESCORED — CVE-2026-12749 (IBM Cloud Pak for Business Automation). CVSS 6.4 → 5.4 (NVD). |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| IBM | Cloud Pak for Business Automation | — | 26.0.0 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-12749 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
