CVE-2025-36386

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-36386", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-04-15T21:16:57.301Z", "datePublished": "2025-10-28T15:56:58.740Z", "dateUpdated": "2025-10-28T16:57:09.538Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:maximo_application_suite:9.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:9.0.15:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:9.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:9.1.4:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "IBM Maximo Application Suite", "vendor": "IBM", "versions": [{"lessThanOrEqual": "9.0.15", "status": "affected", "version": "9.0.0", "versionType": "semver"}, {"lessThanOrEqual": "9.1.4", "status": "affected", "version": "9.1.0", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*", "versionEndIncluding": "9.0.15", "versionStartIncluding": "9.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*", "versionEndIncluding": "9.1.4", "versionStartIncluding": "9.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>IBM Maximo Application Suite 9.0.0 through 9.0.15 and 9.1.0 through 9.1.4 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.</p>"}], "value": "IBM Maximo Application Suite 9.0.0 through 9.0.15 and 9.1.0 through 9.1.4 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-305", "description": "CWE-305 Authentication Bypass by Primary Weakness", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-10-28T15:58:50.265Z"}, "references": [{"tags": ["vendor-advisory", "patch"], "url": "https://www.ibm.com/support/pages/node/7249416"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Remediation/Fixes IBM strongly recommends addressing the vulnerability now by upgrading to fixes from below links MAS Manage Patch Fix or Release Upgrade for MAS 9.0 Fix Central Upgrade for MAS 9.1 Fix Central</p>"}], "value": "Remediation/Fixes IBM strongly recommends addressing the vulnerability now by upgrading to fixes from below links MAS Manage Patch Fix or Release Upgrade for MAS 9.0 Fix Central Upgrade for MAS 9.1 Fix Central"}], "title": "There is a vulnerability in the IBM Maximo Manage application in IBM Maximo Application Suite for Cognos Analytics", "x_generator": {"engine": "ibm-cvegen"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-28T16:54:30.318336Z", "id": "CVE-2025-36386", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-28T16:57:09.538Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-36386", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-04-15T21:16:57.301Z", "datePublished": "2025-10-28T15:56:58.740Z", "dateUpdated": "2025-10-28T16:57:09.538Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:maximo_application_suite:9.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:9.0.15:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:9.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:9.1.4:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "IBM Maximo Application Suite", "vendor": "IBM", "versions": [{"lessThanOrEqual": "9.0.15", "status": "affected", "version": "9.0.0", "versionType": "semver"}, {"lessThanOrEqual": "9.1.4", "status": "affected", "version": "9.1.0", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*", "versionEndIncluding": "9.0.15", "versionStartIncluding": "9.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*", "versionEndIncluding": "9.1.4", "versionStartIncluding": "9.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>IBM Maximo Application Suite 9.0.0 through 9.0.15 and 9.1.0 through 9.1.4 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.</p>"}], "value": "IBM Maximo Application Suite 9.0.0 through 9.0.15 and 9.1.0 through 9.1.4 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-305", "description": "CWE-305 Authentication Bypass by Primary Weakness", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-10-28T15:58:50.265Z"}, "references": [{"tags": ["vendor-advisory", "patch"], "url": "https://www.ibm.com/support/pages/node/7249416"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Remediation/Fixes IBM strongly recommends addressing the vulnerability now by upgrading to fixes from below links MAS Manage Patch Fix or Release Upgrade for MAS 9.0 Fix Central Upgrade for MAS 9.1 Fix Central</p>"}], "value": "Remediation/Fixes IBM strongly recommends addressing the vulnerability now by upgrading to fixes from below links MAS Manage Patch Fix or Release Upgrade for MAS 9.0 Fix Central Upgrade for MAS 9.1 Fix Central"}], "title": "There is a vulnerability in the IBM Maximo Manage application in IBM Maximo Application Suite for Cognos Analytics", "x_generator": {"engine": "ibm-cvegen"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-36386", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-28T16:54:30.318336Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-28T16:57:05.997Z"}}]}}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:maximo_application_suite:9.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:9.0.15:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:9.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:maximo_application_suite:9.1.4:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "IBM Maximo Application Suite", "vendor": "IBM", "versions": [{"lessThanOrEqual": "9.0.15", "status": "affected", "version": "9.0.0", "versionType": "semver"}, {"lessThanOrEqual": "9.1.4", "status": "affected", "version": "9.1.0", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*", "matchCriteriaId": "4DF88C5A-C790-4F97-8672-A23C38D6B798", "versionEndIncluding": "9.0.15", "versionStartIncluding": "9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*", "matchCriteriaId": "184F8AEA-D1BE-431E-9139-06787DA73A89", "versionEndIncluding": "9.1.4", "versionStartIncluding": "9.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Maximo Application Suite 9.0.0 through 9.0.15 and 9.1.0 through 9.1.4 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application."}, {"lang": "es", "value": "IBM Maximo Application Suite 9.0.0 hasta 9.0.15 y 9.1.0 hasta 9.1.4 podr\u00eda permitir a un atacante remoto eludir los mecanismos de autenticaci\u00f3n y obtener acceso no autorizado a la aplicaci\u00f3n."}], "id": "CVE-2025-36386", "lastModified": "2026-09-26T00:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "psirt@us.ibm.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-36386", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-28T16:54:30.318336Z", "version": "2.0.3"}}]}, "published": "2025-10-28T16:15:38.107", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7249416"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-305"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{}