What’s Vulnerable › Vulnerabilities
CVE-2025-36023: IBM Cloud Pak for Business Automation security bypass
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-08-08 · updated 2026-06-17
- Weakness: CWE-639
Description
IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF005 and 24.0.1 through 24.0.1 IF002 could allow an authenticated user to view sensitive user and system information due to an indirect object reference through a user-controlled key.
Affected products
- IBM Cloud Pak for Business Automation: 24.0.0, 24.0.0-interim_fix_001, 24.0.0-interim_fix_004, 24.0.0-interim_fix_005, 24.0.1, 24.0.1-interim_fix_001 (+1)
References
Get alerted when CVE-2025-36023 or the next vulnerability affects your stack