CVE-2025-36220
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
IBM Cloud Pak for Data System - Cyclops versions 11.3.0.2 through Interim Fix 002 is vulnerable to SQL injection. A remote attacker can send crafted SQL statements to view, add, modify, or delete data in the backend database.
Risk Assessment
An attacker can gain unauthorized access to sensitive data in the database, and also modify or delete it, posing a serious breach of confidentiality and integrity.
Recommendation
Apply the fix from IBM (Interim Fix 003 or later) or temporarily restrict access to the vulnerable component.
Other vulnerabilities in IBM Cloud Pak for Data System
See all- CVE-2026-3686Medium
IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 is vulnerable to a denial of service due to improper limitation of resources.
- CVE-2025-36221Medium
IBM Cloud Pak for Data System - Cyclops 11.3.0.2 through Interim Fix 002 uses default passwords from the manufacturing process during installation. This could allow an attacker to bypass authentication.
Original NVD description (English source)
IBM Cloud Pak for Data System - Cyclops 11.3.0.2 through Interim Fix 002 IBM Cloud Pak for Data System is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.