CVE-2025-36093CWE-602

CVE-2025-36093

Medium · published November 3, 2025

CVSS v3.1
4.8
EPSS
0%
Percentile
17.5
In the wild
Unconfirmed
What it is

IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an attacker to access unauthorized content or perform unauthorized actions using man in the middle techniques due to improper access controls.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00266 · 17.5th percentile
Weakness
CWE-602 · Client-Side Enforcement of Server-Side Security
Published
2025-11-03T21:15Z
Affected products (11)
ProductVersionsFixed in
ibm/cloud_pak_for_business_automationall versions—
ibm/cloud_pak_for_business_automationall versions—
ibm/cloud_pak_for_business_automationall versions—
ibm/cloud_pak_for_business_automationall versions—
ibm/cloud_pak_for_business_automationall versions—
ibm/cloud_pak_for_business_automationall versions—
ibm/cloud_pak_for_business_automationall versions—
ibm/cloud_pak_for_business_automationall versions—
ibm/cloud_pak_for_business_automationall versions—
ibm/cloud_pak_for_business_automationall versions—
ibm/cloud_pak_for_business_automationall versions—
References (1)
https://www.ibm.com/support/pages/node/7249999 · [email protected]
EPSS history
Timeline
  • 03 NOV 15:54Z
    security vulnerabilities are addressed with IBM Business Automation Insights iFixes for October 2025.
    cvelistv5