CVE-2025-36222

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-36222", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-04-15T21:16:41.802Z", "datePublished": "2025-09-11T20:44:06.696Z", "dateUpdated": "2026-02-26T17:48:40.895Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:storage_fusion:2.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_fusion:2.10.1:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Fusion", "vendor": "IBM", "versions": [{"lessThanOrEqual": "2.10.1", "status": "affected", "version": "2.2.0", "versionType": "semver"}]}, {"cpes": ["cpe:2.3:a:ibm:storage_fusion_hci:2.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_fusion_hci:2.10.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Fusion HCI", "vendor": "IBM", "versions": [{"lessThanOrEqual": "2.10.0", "status": "affected", "version": "2.2.0", "versionType": "semver"}]}, {"cpes": ["cpe:2.3:a:ibm:storage_fusion_hci_for_watsonx:2.8.2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_fusion_hci_for_watsonx:2.10.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Fusion HCI for watsonx", "vendor": "IBM", "versions": [{"lessThanOrEqual": "2.10.0", "status": "affected", "version": "2.8.2", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Robert Hotchkiss"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "IBM Fusion 2.2.0 through 2.10.1, IBM Fusion HCI 2.2.0 through 2.10.0, and IBM Fusion HCI for watsonx 2.8.2 through 2.10.0 uses insecure default configurations that could expose AMQStreams without client authentication that could allow an attacker to perform unauthorized actions."}], "value": "IBM Fusion 2.2.0 through 2.10.1, IBM Fusion HCI 2.2.0 through 2.10.0, and IBM Fusion HCI for watsonx 2.8.2 through 2.10.0 uses insecure default configurations that could expose AMQStreams without client authentication that could allow an attacker to perform unauthorized actions."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1188", "description": "CWE-1188 Insecure Default Initialization of Resource", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-09-11T20:44:06.696Z"}, "references": [{"tags": ["vendor-advisory", "patch"], "url": "https://www.ibm.com/support/pages/node/7244646"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>IBM strongly recommends addressing the vulnerability now.</p><div><table><tbody><tr><td><strong>Products</strong></td><td><strong>Version range </strong></td><td><strong>Remediation Instructions</strong></td></tr><tr><td>IBM Fusion</td><td>2.2.0 - 2.10.1</td><td>Upgrade to IBM Fusion 2.11.0. See the <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/node/7242341\">README</a>&nbsp;for instructions..</td></tr><tr><td>IBM Fusion HCI</td><td>2.2.0 - 2.10.0</td><td>Upgrade to IBM Fusion HCI 2.11.0. See the <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/node/7242340\">README</a>&nbsp;for instructions.</td></tr><tr><td>IBM Fusion HCI for watsonx</td><td>2.8.2 - 2.10.0</td><td>Upgrade to IBM Fusion HCI for watsonx 2.11.0. See <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/node/7242340\">README</a>&nbsp;for instructions.</td></tr></tbody></table></div>\n\n<br>"}], "value": "IBM strongly recommends addressing the vulnerability now.\n\nProductsVersion range Remediation InstructionsIBM Fusion2.2.0 - 2.10.1Upgrade to IBM Fusion 2.11.0. See the README https://www.ibm.com/support/pages/node/7242341 \u00a0for instructions..IBM Fusion HCI2.2.0 - 2.10.0Upgrade to IBM Fusion HCI 2.11.0. See the README https://www.ibm.com/support/pages/node/7242340 \u00a0for instructions.IBM Fusion HCI for watsonx2.8.2 - 2.10.0Upgrade to IBM Fusion HCI for watsonx 2.11.0. See README https://www.ibm.com/support/pages/node/7242340 \u00a0for instructions."}], "source": {"discovery": "UNKNOWN"}, "title": "IBM Fusion insecure default configuration", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-36222", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-13T03:55:39.299346Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T17:48:40.895Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-36222", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-13T03:55:39.299346Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-12T13:12:59.747Z"}}], "cna": {"title": "IBM Fusion insecure default configuration", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Robert Hotchkiss"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:storage_fusion:2.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_fusion:2.10.1:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Fusion", "versions": [{"status": "affected", "version": "2.2.0", "versionType": "semver", "lessThanOrEqual": "2.10.1"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:ibm:storage_fusion_hci:2.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_fusion_hci:2.10.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Fusion HCI", "versions": [{"status": "affected", "version": "2.2.0", "versionType": "semver", "lessThanOrEqual": "2.10.0"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:ibm:storage_fusion_hci_for_watsonx:2.8.2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_fusion_hci_for_watsonx:2.10.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Fusion HCI for watsonx", "versions": [{"status": "affected", "version": "2.8.2", "versionType": "semver", "lessThanOrEqual": "2.10.0"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerability now.\n\nProductsVersion range Remediation InstructionsIBM Fusion2.2.0 - 2.10.1Upgrade to IBM Fusion 2.11.0. See the README https://www.ibm.com/support/pages/node/7242341 \u00a0for instructions..IBM Fusion HCI2.2.0 - 2.10.0Upgrade to IBM Fusion HCI 2.11.0. See the README https://www.ibm.com/support/pages/node/7242340 \u00a0for instructions.IBM Fusion HCI for watsonx2.8.2 - 2.10.0Upgrade to IBM Fusion HCI for watsonx 2.11.0. See README https://www.ibm.com/support/pages/node/7242340 \u00a0for instructions.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM strongly recommends addressing the vulnerability now.</p><div><table><tbody><tr><td><strong>Products</strong></td><td><strong>Version range </strong></td><td><strong>Remediation Instructions</strong></td></tr><tr><td>IBM Fusion</td><td>2.2.0 - 2.10.1</td><td>Upgrade to IBM Fusion 2.11.0. See the <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/node/7242341\">README</a>&nbsp;for instructions..</td></tr><tr><td>IBM Fusion HCI</td><td>2.2.0 - 2.10.0</td><td>Upgrade to IBM Fusion HCI 2.11.0. See the <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/node/7242340\">README</a>&nbsp;for instructions.</td></tr><tr><td>IBM Fusion HCI for watsonx</td><td>2.8.2 - 2.10.0</td><td>Upgrade to IBM Fusion HCI for watsonx 2.11.0. See <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/node/7242340\">README</a>&nbsp;for instructions.</td></tr></tbody></table></div>\n\n<br>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7244646", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "IBM Fusion 2.2.0 through 2.10.1, IBM Fusion HCI 2.2.0 through 2.10.0, and IBM Fusion HCI for watsonx 2.8.2 through 2.10.0 uses insecure default configurations that could expose AMQStreams without client authentication that could allow an attacker to perform unauthorized actions.", "supportingMedia": [{"type": "text/html", "value": "IBM Fusion 2.2.0 through 2.10.1, IBM Fusion HCI 2.2.0 through 2.10.0, and IBM Fusion HCI for watsonx 2.8.2 through 2.10.0 uses insecure default configurations that could expose AMQStreams without client authentication that could allow an attacker to perform unauthorized actions.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1188", "description": "CWE-1188 Insecure Default Initialization of Resource"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-09-11T20:44:06.696Z"}}}, "cveMetadata": {"cveId": "CVE-2025-36222", "state": "PUBLISHED", "dateUpdated": "2026-02-26T17:48:40.895Z", "dateReserved": "2025-04-15T21:16:41.802Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2025-09-11T20:44:06.696Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:storage_fusion:2.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_fusion:2.10.1:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Fusion", "vendor": "IBM", "versions": [{"lessThanOrEqual": "2.10.1", "status": "affected", "version": "2.2.0", "versionType": "semver"}]}, {"cpes": ["cpe:2.3:a:ibm:storage_fusion_hci:2.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_fusion_hci:2.10.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Fusion HCI", "vendor": "IBM", "versions": [{"lessThanOrEqual": "2.10.0", "status": "affected", "version": "2.2.0", "versionType": "semver"}]}, {"cpes": ["cpe:2.3:a:ibm:storage_fusion_hci_for_watsonx:2.8.2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_fusion_hci_for_watsonx:2.10.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Fusion HCI for watsonx", "vendor": "IBM", "versions": [{"lessThanOrEqual": "2.10.0", "status": "affected", "version": "2.8.2", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:storage_fusion:*:*:*:*:*:*:*:*", "matchCriteriaId": "BC2A1C1E-916D-4949-8304-D5C75FADFDD2", "versionEndExcluding": "2.11.0", "versionStartIncluding": "2.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:storage_fusion_hci:*:*:*:*:*:*:*:*", "matchCriteriaId": "41053DB8-FC1D-4E64-A596-6632F390AC48", "versionEndExcluding": "2.11.0", "versionStartIncluding": "2.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:storage_fusion_hci_for_watsonx:*:*:*:*:*:*:*:*", "matchCriteriaId": "AF151CF6-B7C2-4A28-9D01-F04FF2DD800E", "versionEndExcluding": "2.11.0", "versionStartIncluding": "2.8.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Fusion 2.2.0 through 2.10.1, IBM Fusion HCI 2.2.0 through 2.10.0, and IBM Fusion HCI for watsonx 2.8.2 through 2.10.0 uses insecure default configurations that could expose AMQStreams without client authentication that could allow an attacker to perform unauthorized actions."}, {"lang": "es", "value": "IBM Fusion 2.2.0 hasta 2.10.1, IBM Fusion HCI 2.2.0 hasta 2.10.0, e IBM Fusion HCI para watsonx 2.8.2 hasta 2.10.0 utilizan configuraciones predeterminadas inseguras que podr\u00edan exponer AMQStreams sin autenticaci\u00f3n del cliente, lo que podr\u00eda permitir a un atacante realizar acciones no autorizadas."}], "id": "CVE-2025-36222", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.8, "source": "psirt@us.ibm.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-36222", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-09-13T03:55:39.299346Z", "version": "2.0.3"}}]}, "published": "2025-09-11T21:15:34.350", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7244646"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1188"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{}