IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users…
Priority MEDIUM 43CWE-521Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-521.
Summary
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 230634.
Why it matters now
EPSS 0.00802 56th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| IBM | Robotic Process Automation | 21.0.0; 21.0.1; 21.0.2 | — | No fix listed | CNA |
- Robotic Process Automation VendorIBM Affected 21.0.0; 21.0.1; 21.0.2 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:21.0.0:*:*:*:*:*:*:* | 21.0.0 | Vulnerable | IBM |
| cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:21.0.1:*:*:*:*:*:*:* | 21.0.1 | Vulnerable | IBM |
| cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:21.0.2:*:*:*:*:*:*:* | 21.0.2 | Vulnerable | IBM |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:21.0.0:*:*:*:*:*:*:* Versions 21.0.0 Vulnerable ·IBM
- cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:21.0.1:*:*:*:*:*:*:* Versions 21.0.1 Vulnerable ·IBM
- cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:21.0.2:*:*:*:*:*:*:* Versions 21.0.2 Vulnerable ·IBM
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-35280
- 2026-10-03 Alias added: GHSA-xwcm-q6m6-465v
References
More IBM Robotic Process Automation For Cloud Pak vulnerabilities
- TI-2023-23069 IBM Robotic Process Automation privilege escalation CVSS 3.1CRITICAL 9.8
- TI-2022-21522 IBM Robotic Process Automation for Cloud Pak session fixation CVSS 3.1HIGH 8.8
- TI-2022-21351 Incorrect default permissions in IBM Robotic Process Automation CVSS 3.1HIGH 7.5
- TI-2022-18554 Insufficiently protected credentials in IBM Robotic Process Automation CVSS 3.1HIGH 7.5
- TI-2023-08785 IBM Robotic Process Automation for Cloud Pak cross-site scripting CVSS 3.1MEDIUM 5.4
- TI-2023-08783 IBM Robotic Process Automation for Cloud Pak insufficient permission settings CVSS 3.1HIGH 7.8
Sources
- CVE-2022-35280 · CVE Program
- CVE-2022-35280 · NVD
- FIRST EPSS
- GHSA-xwcm-q6m6-465v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences