CVE-2025-36093
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an attacker to access unauthorized content or perform unauthorized actions using man-in-the-middle techniques due to improper access controls.
Risk Assessment
An attacker could intercept or modify data, leading to confidentiality and integrity breaches. This may result in unauthorized actions within the system.
Recommendation
Update IBM Cloud Pak For Business Automation to a patched version. Implement strong encryption and authentication to prevent MITM attacks.
Other vulnerabilities in IBM Cloud Pak For Business Automation
See all- CVE-2026-12751Medium
IBM Cloud Pak for Business Automation is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
- CVE-2026-12750Medium
IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
- CVE-2026-12749Medium
IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
- CVE-2026-11864Medium
IBM Cloud Pak for Business Automation versions 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 through 24.0.0 Interim Fix 009 is vulnerable to XPath injection. An authenticated attacker could exfiltrate sensitive application data and/or determine the structure of the XML document.
- CVE-2026-12759Medium
IBM Cloud Pak for Business Automation allows an authenticated user to cause a denial of service due to uncontrolled resource consumption.
- CVE-2026-12758Medium
IBM Cloud Pak for Business Automation allows a remote attacker to bypass authorization and invoke restricted endpoints due to improper validation of HTTP headers.
- CVE-2026-12762Medium
IBM Cloud Pak For Business Automation versions 24.0.0, 24.0.1, 25.0.0, and 26.0.0 could allow a remote attacker to obtain sensitive information exposed in manifest files.
- CVE-2025-36172Medium
IBM Cloud Pak for Business Automation and IBM Business Automation Workflow are vulnerable to stored cross-site scripting. An authenticated user can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.
- CVE-2025-36092Medium
IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause a denial of service due to improper validation of input length.
- CVE-2025-36091Medium
In IBM Cloud Pak for Business Automation 25.0.0, 24.0.1, and 24.0.0, an authenticated user could cause dashboards to become inaccessible to legitimate users due to invalid ownership assignment. The vulnerability relates to the resource ownership assignment mechanism.
Original NVD description (English source)
IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an attacker to access unauthorized content or perform unauthorized actions using man in the middle techniques due to improper access controls.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS