CVE-2025-36245CWE-78command-injection

CVE-2025-36245

High · published September 30, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
38.7
In the wild
Unconfirmed
What it is

IBM InfoSphere 11.7.0.0 through 11.7.1.6 Information Server could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00457 · 38.7th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-09-30T03:15Z
Affected products (1)
ProductVersionsFixed in
ibm/infosphere_information_server≥ 11.7, ≤ 11.7.1.6—
References (1)
https://www.ibm.com/support/pages/node/7246170 · [email protected]
EPSS history
Timeline
  • 29 SEP 22:29Z
    IBM InfoSphere Information Server command execution
    cvelistv5