CVE-2025-36038
BaseFortify
Publication date: 2025-06-25
Last updated on: 2025-07-18
Assigner: IBM Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| ibm | websphere_application_server | From 8.5 (inc) to 8.5.5.28 (exc) |
| ibm | websphere_application_server | From 9.0 (inc) to 9.0.5.25 (exc) |
| hp | hp-ux | * |
| ibm | aix | * |
| ibm | i | * |
| ibm | z\/os | * |
| microsoft | windows | * |
| oracle | solaris | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in IBM WebSphere Application Server 8.5 and 9.0 allows a remote attacker to execute arbitrary code on the affected system by sending a specially crafted sequence of serialized objects. It arises from the deserialization of untrusted data, which can lead to critical security risks without requiring any privileges or user interaction. [1]
How can this vulnerability impact me? :
The vulnerability can have a severe impact by allowing remote attackers to execute arbitrary code, potentially leading to full compromise of the affected system. This includes high impacts on confidentiality, integrity, and availability of the system, meaning sensitive data could be exposed, altered, or destroyed, and system operations could be disrupted. [1]
What immediate steps should I take to mitigate this vulnerability?
IBM recommends immediate remediation by applying the interim fix associated with APAR PH66674. For IBM WebSphere Application Server versions 9.0.0.0 through 9.0.5.24, upgrade to the minimal fix pack level required by the interim fix and then apply the interim fix or alternatively apply Fix Pack 9.0.5.25 or later. For versions 8.5.0.0 through 8.5.5.27, similarly upgrade to the minimal fix pack level and apply the interim fix or apply Fix Pack 8.5.5.28 or later. Additional interim fixes may be available on the interim fix download page. No workarounds or mitigations are provided. [1]