BaseFortify

Publication date: 2025-11-01

Last updated on: 2025-11-05

Assigner: IBM Corporation

Description

IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 is vulnerable to privilege escalation caused by an invalid IBM i SQL services authorization check. A malicious actor can use the elevated privileges of another user profile to gain root access to the host operating system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-01

Last Modified

2025-11-05

Generated

2026-07-06

AI Q&A

2025-11-01

EPSS Evaluated

2026-07-04

NVD

CVE-2025-36367

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	i	7.2
ibm	i	7.3
ibm	i	7.4
ibm	i	7.5
ibm	i	7.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in IBM i versions 7.2 through 7.6 is due to an invalid authorization check in IBM i SQL services. It allows a malicious actor to escalate privileges by using the elevated privileges of another user profile, potentially gaining root access to the host operating system.

Impact Analysis

The vulnerability can allow an attacker to gain root-level access to the host operating system by exploiting privilege escalation. This can lead to full control over the system, compromising confidentiality, integrity, and availability of data and services.

Hi! I’m here to help you understand CVE-2025-36367. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70