{"api_version":"1","generated_at":"2026-10-26T11:08:33+00:00","cve":"CVE-2026-14350","urls":{"html":"https://cve.report/CVE-2026-14350","api":"https://cve.report/api/cve/CVE-2026-14350.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-14350","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-14350"},"summary":{"title":"Vulnerabilities exists in IBM Cloud Pak for Data System","description":"IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.","state":"PUBLISHED","assigner":"ibm","published_at":"2026-09-04 17:16:51","updated_at":"2026-09-08 14:17:08"},"problem_types":["CWE-117","CWE-117 CWE-117 Improper Output Neutralization for Logs"],"metrics":[{"version":"3.1","source":"psirt@us.ibm.com","type":"Secondary","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}}],"references":[{"url":"https://www.ibm.com/support/pages/node/7286036","name":"https://www.ibm.com/support/pages/node/7286036","refsource":"psirt@us.ibm.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14350","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14350","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"IBM","product":"Cloud Pak for Data System","version":"affected 11.3.0.2 Interim Fix 001 semver","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Fix VersionRemediation/FixesIBM Cloud Pak for Data System 11.3.1.2-IF1-WS-ICPDS-NPS-Clients-fp326919 https://www.ibm.com/support/fixcentral/quickorder","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"14350","cve":"CVE-2026-14350","epss":"0.003100000","percentile":"0.234810000","score_date":"2026-09-07","updated_at":"2026-09-08 00:05:26"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-14350","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-04T17:26:41.510422Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-09-04T17:26:52.430Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"cpes":["cpe:2.3:a:ibm:cloud_pak_for_data_system:11.3.0.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:cloud_pak_for_data_system:interim:interim_fix_001:*:*:*:*:*:*"],"product":"Cloud Pak for Data System","vendor":"IBM","versions":[{"lessThanOrEqual":"Interim Fix 001","status":"affected","version":"11.3.0.2","versionType":"semver"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.</p>"}],"value":"IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-117","description":"CWE-117 Improper Output Neutralization for Logs","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-04T16:44:30.963Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7286036"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<div><table><colgroup><col/><col/></colgroup><tbody><tr><td>Fix Version</td><td>Remediation/Fixes</td></tr><tr><td>IBM Cloud Pak for Data System</td><td><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FWebSphere%2FIBM+Cloud+Private+for+Data+System&amp;fixids=11.3.1.2-IF1-WS-ICPDS-NPS-Clients-fp326919&amp;source=SAR\" rel=\"nofollow\">11.3.1.2-IF1-WS-ICPDS-NPS-Clients-fp326919</a></td></tr></tbody></table></div>"}],"value":"Fix VersionRemediation/FixesIBM Cloud Pak for Data System 11.3.1.2-IF1-WS-ICPDS-NPS-Clients-fp326919 https://www.ibm.com/support/fixcentral/quickorder"}],"title":"Vulnerabilities exists in IBM Cloud Pak for Data System"}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2026-14350","datePublished":"2026-09-04T16:44:30.963Z","dateReserved":"2026-07-01T16:32:59.757Z","dateUpdated":"2026-09-04T17:26:52.430Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-04 17:16:51","lastModifiedDate":"2026-09-08 14:17:08","problem_types":["CWE-117","CWE-117 CWE-117 Improper Output Neutralization for Logs"],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-04T17:26:41.510422Z","id":"CVE-2026-14350","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"14350","Ordinal":"1","Title":"Vulnerabilities exists in IBM Cloud Pak for Data System","CVE":"CVE-2026-14350","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"14350","Ordinal":"1","NoteData":"IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.","Type":"Description","Title":"Vulnerabilities exists in IBM Cloud Pak for Data System"}]}}}