CVE-2025-36059
Local OS Command Execution in IBM Business Automation Workflow Containers
Publication date: 2026-01-20
Last updated on: 2026-02-17
Assigner: IBM Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ibm | business_automation_workflow | 24.0.1 |
| ibm | business_automation_workflow | 24.0.0 |
| ibm | business_automation_workflow | 24.0.1 |
| ibm | business_automation_workflow | 24.0.1 |
| ibm | business_automation_workflow | 24.0.1 |
| ibm | business_automation_workflow | 24.0.1 |
| ibm | business_automation_workflow | 25.0.0 |
| ibm | business_automation_workflow | 24.0.0 |
| ibm | business_automation_workflow | 24.0.0 |
| ibm | business_automation_workflow | 24.0.0 |
| ibm | business_automation_workflow | 24.0.0 |
| ibm | business_automation_workflow | 24.0.0 |
| ibm | business_automation_workflow | 24.0.0 |
| ibm | business_automation_workflow | 25.0.0 |
| ibm | business_automation_workflow | 25.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-250 | The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in IBM Business Automation Workflow containers versions 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 006. It allows a local user who has access to the container to execute operating system system calls, which could lead to unauthorized actions within the container environment.
How can this vulnerability impact me? :
The vulnerability could allow a local user with access to the container to execute OS system calls, potentially leading to unauthorized modification or control of the container environment. This could impact the integrity of the system and lead to security risks such as privilege escalation or unauthorized actions within the container.