CVE-2025-36356CWE-250

CVE-2025-36356

Critical · published October 6, 2025

CVSS v3.1
9.3
EPSS
0%
Percentile
8.4
In the wild
Unconfirmed
What it is

🚨 A locally authenticated user can take over as root! This privilege escalation vulnerability affects IBM Security Verify Access versions 10.0.0.0 to 10.0.9.0 and 11.0.0.0 to 11.0.1.0, and it’s about as serious as it gets! 🔥 Think of it like a hotel where a guest finds a hidden key to the manager's office and can start changing bookings, accessing sensitive information, or even shutting down the entire operation – talk about a nightmare for the management! An attacker with local access could elevate their privileges to root, allowing them to execute any command they want. This means they could manipulate data, alter configurations, and even compromise the entire system. The implications? Absolute chaos and a major security breach that could put sensitive information at risk!

Put simply

Think of it like a hotel where a guest finds a hidden key to the manager's office and can start changing bookings, accessing sensitive information, or even shutting down the entire operation – talk about a nightmare for the management! This vulnerability arises from the system executing with more privileges than necessary, allowing a locally authenticated user to escalate their privileges to root without proper authorization checks.

What to do

An attacker with local access could elevate their privileges to root, allowing them to execute any command they want. This means they could manipulate data, alter configurations, and even compromise the entire system. The implications? Absolute chaos and a major security breach that could put sensitive information at risk! Immediately update your IBM Security Verify Access to the latest version to close this security gap. Review and restrict access permissions to ensure that only authorized users have local access—and keep an eye on your security configurations to prevent future exploits! You've got this! Tackling vulnerabilities like this one puts you in the spotlight as a true security hero! 🦸

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00192 · 8.4th percentile
Weakness
CWE-250 · Execution with Unnecessary Privileges
Published
2025-10-06T21:16Z
Affected products (12)
ProductVersionsFixed in
ibm/security_verify_access≥ 10.0.0.0, < 10.0.9.010.0.9.0
ibm/security_verify_accessall versions—
ibm/security_verify_accessall versions—
ibm/security_verify_accessall versions—
ibm/security_verify_access_docker≥ 10.0.0.0, < 10.0.9.010.0.9.0
ibm/security_verify_access_dockerall versions—
ibm/security_verify_access_dockerall versions—
ibm/security_verify_access_dockerall versions—
ibm/verify_identity_access≥ 11.0.0.0, < 11.0.1.011.0.1.0
ibm/verify_identity_accessall versions—
ibm/verify_identity_access_docker≥ 11.0.0.0, < 11.0.1.011.0.1.0
ibm/verify_identity_access_dockerall versions—
References (1)
EPSS history
Timeline
  • 06 OCT 16:50Z
    IBM Security Verify Access privilege escalation
    cvelistv5