CVE-2025-36059

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-36059", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-04-15T21:16:11.325Z", "datePublished": "2026-01-20T15:07:46.448Z", "dateUpdated": "2026-01-20T15:54:41.357Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:business_automation_workflow_containers:25.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:business_automation_workflow_containers:25.0.0:interim_fix_002:*:*:*:*:*:*", "cpe:2.3:a:ibm:business_automation_workflow_containers:24.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:business_automation_workflow_containers:24.0.1:interim_fix_005:*:*:*:*:*:*", "cpe:2.3:a:ibm:business_automation_workflow_containers:24.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:business_automation_workflow_containers:24.0.0:interim_fix_006:*:*:*:*:*:*"], "product": "Business Automation Workflow containers", "vendor": "IBM", "versions": [{"lessThanOrEqual": "25.0.0 Interim Fix 002", "status": "affected", "version": "25.0.0", "versionType": "semver"}, {"lessThanOrEqual": "24.0.1 Interim Fix 005", "status": "affected", "version": "24.0.1", "versionType": "semver"}, {"lessThanOrEqual": "24.0.0 Interim Fix 006", "status": "affected", "version": "24.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>IBM Business Automation Workflow containers 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 006. IBM Cloud Pak for Business Automation could allow a local user with access to the container to execute OS system calls.</p>"}], "value": "IBM Business Automation Workflow containers 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 006. IBM Cloud Pak for Business Automation could allow a local user with access to the container to execute OS system calls."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-250", "description": "CWE-250 Execution with Unnecessary Privileges", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-01-20T15:07:46.448Z"}, "references": [{"tags": ["vendor-advisory", "patch"], "url": "https://www.ibm.com/support/pages/node/7256777"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<br><table><thead><tr><th>Affected Product(s)</th><th>Version(s)</th><th>Remediation / Fix</th></tr></thead><tbody><tr><td>IBM Business Automation Workflow containers</td><td>V25.0.0 - V25.0.0-IF002</td><td>Apply <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/readme-ibm-business-automation-workflow-containers-25000-interim-fixes\">25.0.0-IF003</a></td></tr><tr><td>IBM Business Automation Workflow containers</td><td>V24.0.1 - V24.0.1-IF005</td><td>Apply <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/node/7183042\">24.0.1-IF006</a></td></tr><tr><td>IBM Business Automation Workflow containers</td><td>V24.0.0 - V24.0.0-IF006</td><td>Apply <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/node/7159792\">24.0.0-IF007</a></td></tr></tbody></table><br>"}], "value": "Affected Product(s)Version(s)Remediation / FixIBM Business Automation Workflow containersV25.0.0 - V25.0.0-IF002Apply 25.0.0-IF003 https://www.ibm.com/support/pages/readme-ibm-business-automation-workflow-containers-25000-interim-fixes IBM Business Automation Workflow containersV24.0.1 - V24.0.1-IF005Apply 24.0.1-IF006 https://www.ibm.com/support/pages/node/7183042 IBM Business Automation Workflow containersV24.0.0 - V24.0.0-IF006Apply 24.0.0-IF007 https://www.ibm.com/support/pages/node/7159792"}], "title": "Multiple security vulnerabilities are addressed in IBM Business Automation Workflow Containers fixes December 2025", "x_generator": {"engine": "ibm-cvegen"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T15:54:23.071587Z", "id": "CVE-2025-36059", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T15:54:41.357Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-36059", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T15:54:23.071587Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T15:54:33.983Z"}}], "cna": {"title": "Multiple security vulnerabilities are addressed in IBM Business Automation Workflow Containers fixes December 2025", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:business_automation_workflow_containers:25.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:business_automation_workflow_containers:25.0.0:interim_fix_002:*:*:*:*:*:*", "cpe:2.3:a:ibm:business_automation_workflow_containers:24.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:business_automation_workflow_containers:24.0.1:interim_fix_005:*:*:*:*:*:*", "cpe:2.3:a:ibm:business_automation_workflow_containers:24.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:business_automation_workflow_containers:24.0.0:interim_fix_006:*:*:*:*:*:*"], "vendor": "IBM", "product": "Business Automation Workflow containers", "versions": [{"status": "affected", "version": "25.0.0", "versionType": "semver", "lessThanOrEqual": "25.0.0 Interim Fix 002"}, {"status": "affected", "version": "24.0.1", "versionType": "semver", "lessThanOrEqual": "24.0.1 Interim Fix 005"}, {"status": "affected", "version": "24.0.0", "versionType": "semver", "lessThanOrEqual": "24.0.0 Interim Fix 006"}]}], "solutions": [{"lang": "en", "value": "Affected Product(s)Version(s)Remediation / FixIBM Business Automation Workflow containersV25.0.0 - V25.0.0-IF002Apply 25.0.0-IF003 https://www.ibm.com/support/pages/readme-ibm-business-automation-workflow-containers-25000-interim-fixes IBM Business Automation Workflow containersV24.0.1 - V24.0.1-IF005Apply 24.0.1-IF006 https://www.ibm.com/support/pages/node/7183042 IBM Business Automation Workflow containersV24.0.0 - V24.0.0-IF006Apply 24.0.0-IF007 https://www.ibm.com/support/pages/node/7159792", "supportingMedia": [{"type": "text/html", "value": "<br><table><thead><tr><th>Affected Product(s)</th><th>Version(s)</th><th>Remediation / Fix</th></tr></thead><tbody><tr><td>IBM Business Automation Workflow containers</td><td>V25.0.0 - V25.0.0-IF002</td><td>Apply <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/readme-ibm-business-automation-workflow-containers-25000-interim-fixes\">25.0.0-IF003</a></td></tr><tr><td>IBM Business Automation Workflow containers</td><td>V24.0.1 - V24.0.1-IF005</td><td>Apply <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/node/7183042\">24.0.1-IF006</a></td></tr><tr><td>IBM Business Automation Workflow containers</td><td>V24.0.0 - V24.0.0-IF006</td><td>Apply <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/node/7159792\">24.0.0-IF007</a></td></tr></tbody></table><br>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7256777", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "ibm-cvegen"}, "descriptions": [{"lang": "en", "value": "IBM Business Automation Workflow containers 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 006. IBM Cloud Pak for Business Automation could allow a local user with access to the container to execute OS system calls.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM Business Automation Workflow containers 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 006. IBM Cloud Pak for Business Automation could allow a local user with access to the container to execute OS system calls.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-250", "description": "CWE-250 Execution with Unnecessary Privileges"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-01-20T15:07:46.448Z"}}}, "cveMetadata": {"cveId": "CVE-2025-36059", "state": "PUBLISHED", "dateUpdated": "2026-01-20T15:54:41.357Z", "dateReserved": "2025-04-15T21:16:11.325Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-01-20T15:07:46.448Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:business_automation_workflow_containers:25.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:business_automation_workflow_containers:25.0.0:interim_fix_002:*:*:*:*:*:*", "cpe:2.3:a:ibm:business_automation_workflow_containers:24.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:business_automation_workflow_containers:24.0.1:interim_fix_005:*:*:*:*:*:*", "cpe:2.3:a:ibm:business_automation_workflow_containers:24.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:business_automation_workflow_containers:24.0.0:interim_fix_006:*:*:*:*:*:*"], "product": "Business Automation Workflow containers", "vendor": "IBM", "versions": [{"lessThanOrEqual": "25.0.0 Interim Fix 002", "status": "affected", "version": "25.0.0", "versionType": "semver"}, {"lessThanOrEqual": "24.0.1 Interim Fix 005", "status": "affected", "version": "24.0.1", "versionType": "semver"}, {"lessThanOrEqual": "24.0.0 Interim Fix 006", "status": "affected", "version": "24.0.0", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:business_automation_workflow:24.0.0:-:*:*:containers:*:*:*", "matchCriteriaId": "EF29B7C7-5024-4A85-ADE5-D94E9002181D", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if001:*:*:containers:*:*:*", "matchCriteriaId": "8464D4F4-1F9A-479B-B689-C6E90BC3AF45", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if002:*:*:containers:*:*:*", "matchCriteriaId": "0FE0DB1D-5728-4075-BE84-48F06E22FDF5", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if003:*:*:containers:*:*:*", "matchCriteriaId": "A4AB37B4-DF91-4DC7-AFB9-107E5B1B2BF6", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if004:*:*:containers:*:*:*", "matchCriteriaId": "79318EB6-001D-4D75-952C-87297C90A0C8", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if005:*:*:containers:*:*:*", "matchCriteriaId": "38F4B5AC-AC9D-48E7-9EC8-48C086CC62A6", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if006:*:*:containers:*:*:*", "matchCriteriaId": "73BAD8DC-3081-4D07-8E65-7501351DE025", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_automation_workflow:24.0.1:-:*:*:containers:*:*:*", "matchCriteriaId": "D5D9EC44-05CE-44FA-AFDE-A4FA326A54F7", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if001:*:*:containers:*:*:*", "matchCriteriaId": "AD2EC4AD-EF47-450F-AA73-8BEE3DADEA1A", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if002:*:*:containers:*:*:*", "matchCriteriaId": "0CFCCD13-9342-4D3D-BE9C-ABCA4EA27229", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if004:*:*:containers:*:*:*", "matchCriteriaId": "5797C332-AE9A-40BF-BAA4-7ECDDEAA907C", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if005:*:*:containers:*:*:*", "matchCriteriaId": "D0F5EB0D-CAF6-45BC-967B-472F1C2833D9", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_automation_workflow:25.0.0:-:*:*:containers:*:*:*", "matchCriteriaId": "3058E645-44E1-4FF0-9A97-E04324BB8968", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if001:*:*:containers:*:*:*", "matchCriteriaId": "0E06ACEC-AC03-41AA-91C7-BA84457847A7", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if002:*:*:containers:*:*:*", "matchCriteriaId": "6AD427CB-B553-4ACB-B2A3-1648848D6D09", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Business Automation Workflow containers 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 006. IBM Cloud Pak for Business Automation could allow a local user with access to the container to execute OS system calls."}, {"lang": "es", "value": "Contenedores de IBM Business Automation Workflow 25.0.0 hasta 25.0.0 Interim Fix 002, 24.0.1 hasta 24.0.1 Interim Fix 005, y 24.0.0 hasta 24.0.0 Interim Fix 006. IBM Cloud Pak para Business Automation podr\u00eda permitir a un usuario local con acceso al contenedor ejecutar llamadas al sistema operativo."}], "id": "CVE-2025-36059", "lastModified": "2026-06-17T09:14:26.000", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "psirt@us.ibm.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-36059", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T15:54:23.071587Z", "version": "2.0.3"}}]}, "published": "2026-01-20T16:16:02.920", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7256777"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-250"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{}