CVE-2023-47140 is a medium severity flaw in IBM CICS Transaction Gateway 9.3 containers, scored 4.0. A user could transfer or view files because of improper access controls. IBM's fix is a network policy that restricts ingress and egress for the container, since no patch or workaround is listed.
What's affected
IBM's bulletin says CICS Transaction Gateway Containers 9.3 are vulnerable if proper egress and ingress policies are not configured at either the pod or the host level. The affected platforms are Linux on IBM Z and Linux on Intel containers for CICS Transaction Gateway for Multiplatforms 9.3.0.0.
IBM lists the remediation as creating a network policy for the container, using its instructions on restricting network traffic. IBM also lists workarounds and mitigations as none. So the control is configuration, not a new version.
The scoring agrees across sources at 4.0. IBM's own vector is CVSS 3.0 with a local attack vector and high complexity. The record uses the same values under CVSS 3.1. The bulletin was first published on 3 January 2024.
The NVD record was published on 2024-01-08, scores 4.0 (Medium), and carries the vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N. Weakness class: CWE-266.
How to check if you're exposed
Look at the network policy for your CICS Transaction Gateway pods or hosts.
kubectl get networkpolicy -n YOUR_NAMESPACE
kubectl describe networkpolicy -n YOUR_NAMESPACE
Confirm that a policy selects the gateway pods and that both ingress and egress are limited to the traffic you need. If you run containers outside Kubernetes, check the equivalent host firewall or container network settings. Also confirm you are running the 9.3 container image, since the bulletin covers that version.
What to do now
- Identify every CICS Transaction Gateway 9.3 container deployment.
- Apply a network policy that limits ingress and egress at the pod or host level, following IBM's instructions.
- Test that the gateway still reaches the CICS regions and clients it needs.
- Log denied connections so you can see unexpected traffic.
- Review the IBM bulletin for later changes.
Why it matters
The weakness is CWE-266, incorrect privilege assignment. In this case IBM places responsibility partly on the deployment: without network policy, a user can transfer or view files they should not reach.
The rating is medium because of the local vector and the high complexity. Still, container workloads often run with permissive networking by default, and the same missing policy affects other services in the namespace. The record's KEV flag is false, so this CVE is not on the CISA Known Exploited Vulnerabilities list.
Network policy is a durable control. Setting it up once helps with this CVE and with future ones.
Quick check
Is there a patch?
IBM's bulletin lists the remediation as a network policy and lists workarounds as none.
Sources
Last reviewed: 19 October 2026.
