CVE-2025-13375CWE-250

IBM Common Cryptographic Architecture Arbitrary Command Execution

Critical · published February 4, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
45.8
In the wild
Unconfirmed
What it is

🚨 Unauthenticated users can wreak havoc with this one! The IBM Common Cryptographic Architecture (CCA) versions 7.5.52 and 8.4.82 are vulnerable to remote command execution — a golden ticket for attackers! 🔥 Think of it like a bank vault that has a faulty lock — anyone can just waltz in and access the valuables inside without ever needing a key! This vulnerability opens the door to elevated privileges that should be tightly secured. An attacker could orchestrate a full-scale invasion, executing arbitrary commands that could disrupt operations or compromise sensitive data. This isn't just a minor inconvenience; it's a critical breach that could lead to devastating consequences for your organization's security and trust.

Put simply

Think of it like a bank vault that has a faulty lock — anyone can just waltz in and access the valuables inside without ever needing a key! This vulnerability opens the door to elevated privileges that should be tightly secured. This vulnerability in IBM CCA allows unauthenticated users to execute commands with elevated privileges, exploiting a flaw in the authentication process that fails to adequately verify user legitimacy.

What to do

An attacker could orchestrate a full-scale invasion, executing arbitrary commands that could disrupt operations or compromise sensitive data. This isn't just a minor inconvenience; it's a critical breach that could lead to devastating consequences for your organization's security and trust. Patch immediately to the latest versions to close this vulnerability. Ensure that your security policies are updated, and review access controls to limit exposure. Regular audits can further help in identifying any unauthorized access attempts. You've got this! By taking swift action, you'll be fortifying your defenses and keeping your systems safe. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00559 · 45.8th percentile
Weakness
CWE-250 · Execution with Unnecessary Privileges
Published
2026-02-04T20:31Z
EPSS history
Timeline
  • 04 FEB 20:31Z
    IBM Common Cryptographic Architecture Arbitrary Command Execution
    cvelistv5