CVE-2023-38273 is a high severity (CVSS 7.5) flaw in IBM Cloud Pak System: an inadequate account lockout setting lets a remote attacker brute force account credentials. IBM's bulletin lists an interim fix for each affected release, so apply the one that matches your version.
What's affected
The affected product is IBM Cloud Pak System. The record lists versions 2.3.1.1, 2.3.2.0 and 2.3.3.7, and IBM's bulletin is more detailed. It lists Cloud Pak System 2.3.1.1 and 2.3.2.0 and the Software Suite 2.3.3.7 on Power, and 2.3.3.0 through 2.3.3.6 on Intel. The record is dated 2024-02-02 and scores 7.5, High, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. IBM's bulletin gives the same score.
IBM's remediation depends on the platform. For Power on 2.3.0.1, 2.3.1.1 or 2.3.2.0, it says to upgrade to 2.3.3.7 and apply Interim Fix 01. For 2.3.3.7 on Power, apply Interim Fix 01. For Intel versions 2.3.3.0 through 2.3.3.6, it says to upgrade to 2.3.3.6 with interim fix 1 and apply Interim Fix 2 from Fix Central. For unsupported versions IBM recommends upgrading to a supported release. IBM lists no workarounds.
Weakness class: CWE-307.
How to check if you're exposed
Read the version in the Cloud Pak System web console, under the system information page, and note whether the system is a Power or an Intel model. Compare it with the list above.
Also review authentication logs for bursts of failed logins against the same account, which is how this weakness shows up in practice.
What to do now
- Identify each Cloud Pak System, its platform (Power or Intel) and its version.
- Apply the interim fix IBM lists for your exact version from IBM Fix Central.
- Upgrade any unsupported version to a supported release first.
- Review login logs for repeated failures and lock or reset accounts that show them.
- Put the management interface behind a VPN or a restricted network.
Why it matters
Account lockout or throttling slows a guesser to the point where guessing stops being practical. When the setting is too lenient, an attacker can try passwords at network speed. The success rate depends on password strength, so weak or reused passwords on administrative accounts are the real prize.
The vector shows no privileges and no user interaction are needed, only network reach. That makes exposure of the management interface the main variable. Strong passwords and multi-factor sign in help beyond the interim fix. The CVE is not on the CISA Known Exploited Vulnerabilities list, and IBM's bulletin does not report exploitation.
Improper restriction of excessive authentication attempts means a login can be guessed at without the system slowing or stopping the guesser. A sensible lockout or throttling policy, combined with strong passwords and multi-factor sign in, makes automated guessing impractical.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the dependencies a code project declares. It does not see firmware, desktop software or vendor appliances, so keep this item in your asset inventory and track the vendor's advisory.
Quick check
How do I know which fix I need?
Match your version and platform, Power or Intel, to the remediation list in IBM's bulletin.
Is there a workaround?
IBM lists none. Restricting access to the management interface lowers exposure while you patch.
Sources
Last reviewed: 19 October 2026.
