CVE-2025-36245
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.
Risk Assessment
An authenticated user could escalate privileges and gain full control over the system, potentially leading to compromise of confidentiality, integrity, and availability of data.
Recommendation
Apply patches from IBM and restrict user privileges to the minimum necessary. Also regularly audit system logs for unusual activities.
Other vulnerabilities in IBM InfoSphere Information Server
See all- CVE-2017-1469High
IBM InfoSphere Information Server versions 9.1, 11.3, and 11.5 could allow a local user to gain elevated privileges by placing arbitrary files in installation directories.
- CVE-2016-6059High
IBM InfoSphere Information Server is vulnerable to a denial of service caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume all available memory resources.
- CVE-2026-9836Low
IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 are affected by an information disclosure vulnerability. An attacker could exploit this flaw to gain access to sensitive data.
- CVE-2025-12832Medium
Server-Side Request Forgery (SSRF) vulnerability in IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6. Allows an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
- CVE-2025-33003High
IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow a non-root user to gain higher privileges/capabilities within the scope of a container due to execution with unnecessary privileges.
- CVE-2023-35898Medium
IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information due to an insecure security configuration in InfoSphere Data Flow Designer.
- CVE-2023-33857Medium
IBM InfoSphere Information Server version 11.7 could allow a remote attacker to obtain system information using a specially crafted query, which could aid in further attacks against the system.
Original NVD description (English source)
IBM InfoSphere 11.7.0.0 through 11.7.1.6 Information Server could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS