BaseFortify

Publication date: 2025-11-03

Last updated on: 2025-11-05

Assigner: IBM Corporation

Description

IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an attacker to access unauthorized content or perform unauthorized actions using man in the middle techniques due to improper access controls.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-03

Last Modified

2025-11-05

Generated

2026-07-06

AI Q&A

2025-11-03

EPSS Evaluated

2026-07-05

NVD

CVE-2025-36093

EUVD

EUVD-2025-37490

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	cloud_pak_for_business_automation	24.0.0
ibm	cloud_pak_for_business_automation	24.0.0
ibm	cloud_pak_for_business_automation	24.0.0
ibm	cloud_pak_for_business_automation	24.0.0
ibm	cloud_pak_for_business_automation	24.0.0
ibm	cloud_pak_for_business_automation	24.0.1
ibm	cloud_pak_for_business_automation	24.0.1
ibm	cloud_pak_for_business_automation	24.0.1
ibm	cloud_pak_for_business_automation	24.0.1
ibm	cloud_pak_for_business_automation	25.0.0
ibm	cloud_pak_for_business_automation	25.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-602	The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

Attack-Flow Graph

Executive Summary

This vulnerability in IBM Cloud Pak For Business Automation versions 25.0.0, 24.0.1, and 24.0.0 allows an attacker to access unauthorized content or perform unauthorized actions by exploiting man-in-the-middle techniques due to improper access controls.

Impact Analysis

An attacker exploiting this vulnerability could gain unauthorized access to sensitive content or perform unauthorized actions within the affected IBM Cloud Pak For Business Automation environments, potentially compromising confidentiality and integrity of data.

Hi! I’m here to help you understand CVE-2025-36093. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70