CVE-2025-36367CWE-862broken-access-control

CVE-2025-36367

High · published November 1, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
22.9
In the wild
Unconfirmed
What it is

⚡ A sneaky privilege escalation vulnerability lurks in IBM i, allowing bad actors to wield the powers of another user profile! 🔥 Think of this vulnerability like a receptionist who gives out the boss's keys without checking their ID. Just one small oversight can lead to someone getting access to the entire office, potentially changing everything inside! If exploited, a malicious actor could gain root access to the host operating system, essentially taking control as if they were the system administrator. This could lead to devastating consequences, including data breaches, unauthorized changes, and a complete takeover of the system. It’s a recipe for chaos!

Put simply

Think of this vulnerability like a receptionist who gives out the boss's keys without checking their ID. Just one small oversight can lead to someone getting access to the entire office, potentially changing everything inside! This privilege escalation issue arises from an invalid authorization check in IBM i SQL services, enabling an attacker to exploit the permissions of another user profile to escalate their privileges.

What to do

If exploited, a malicious actor could gain root access to the host operating system, essentially taking control as if they were the system administrator. This could lead to devastating consequences, including data breaches, unauthorized changes, and a complete takeover of the system. It’s a recipe for chaos! To protect your systems, upgrade to the fixed version as soon as possible. Ensure that access controls are rigorously enforced and review user permissions to prevent unauthorized access. Regular audits will help keep your environment secure! You've got this, security hero! With these steps, you'll lock down your system in no time. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00312 · 22.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-11-01T16:15Z
Affected products (5)
ProductVersionsFixed in
ibm/iall versions—
ibm/iall versions—
ibm/iall versions—
ibm/iall versions—
ibm/iall versions—
References (1)
EPSS history
Timeline
  • 01 NOV 12:01Z
    IBM i is affected by a privilege escalation in IBM i SQL services
    cvelistv5