What’s Vulnerable › Vulnerabilities

CVE-2025-36359: IBM DevOps Loop is susceptible to an Insufficient Session Expiration vulnerability.

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-30 · updated 2026-10-06
• Weakness: CWE-613

Description

IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expiration which could allow an authenticated user to impersonate another user on the system.

Affected products

• IBM DevOps Automation: 1.0.1
• IBM DevOps Loop: 1.0.2

References

• https://www.ibm.com/support/pages/node/7277970

Get alerted when CVE-2025-36359 or the next vulnerability affects your stack