CVE-2025-36397CWE-80

Security vulnerabilities have been found in IBM Application Gateway

Medium · published January 20, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
9.0
In the wild
Unconfirmed
What it is

IBM Application Gateway 23.10 through 25.09 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00197 · 9.0th percentile
Weakness
CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2026-01-20T15:23Z
EPSS history
Timeline
  • 20 JAN 15:23Z
    Security vulnerabilities have been found in IBM Application Gateway
    cvelistv5