CVE-2025-36017

MediumCVSS 6.5

Published: 08/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

17th percentile - higher than 17% of all known CVEs

Summary

IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 store unencrypted sensitive information in environmental variables files, which can be obtained by an authenticated user.

Risk Assessment

The risk includes potential disclosure of sensitive information to authenticated users, which may lead to privilege escalation or unauthorized access.

Recommendation

Encrypt sensitive information in environmental variables files and restrict access to these files.

Other vulnerabilities in IBM Controller / IBM Cognos Controller

CVE-2025-33111Medium
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 are vulnerable to creation of temporary files without atomic operations, which may expose sensitive information to an authenticated user due to race condition attacks.

Original NVD description (English source)

IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 stores unencrypted sensitive information in environmental variables files which can be obtained by an authenticated user.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS