security vulnerabilities are addressed with IBM Business Automation Insights iFixes for October 2025.
Summary
| CVE | CVE-2025-36093 |
|---|---|
| State | PUBLISHED |
| Assigner | ibm |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-11-03 16:15:34 UTC |
| Updated | 2026-06-17 09:14:28 UTC |
| Description | IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an attacker to access unauthorized content or perform unauthorized actions using man in the middle techniques due to improper access controls. |
Risk And Classification
Primary CVSS: v3.1 7.4 HIGH from [email protected]
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS: 0.002660000 probability, percentile 0.172770000 (date 2026-10-18)
Problem Types: CWE-602 | CWE-602 CWE-602 Client-Side Enforcement of Server-Side Security
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 7.4 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
| 3.1 | [email protected] | Secondary | 4.8 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
| 3.1 | CNA | CVSS | 4.8 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
NoneCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Ibm | Cloud Pak For Business Automation | 24.0.0 | - | All | All |
| Application | Ibm | Cloud Pak For Business Automation | 24.0.0 | interim_fix_001 | All | All |
| Application | Ibm | Cloud Pak For Business Automation | 24.0.0 | interim_fix_002 | All | All |
| Application | Ibm | Cloud Pak For Business Automation | 24.0.0 | interim_fix_003 | All | All |
| Application | Ibm | Cloud Pak For Business Automation | 24.0.0 | interim_fix_004 | All | All |
| Application | Ibm | Cloud Pak For Business Automation | 24.0.1 | - | All | All |
| Application | Ibm | Cloud Pak For Business Automation | 24.0.1 | interim_fix_001 | All | All |
| Application | Ibm | Cloud Pak For Business Automation | 24.0.1 | interim_fix_002 | All | All |
| Application | Ibm | Cloud Pak For Business Automation | 24.0.1 | interim_fix_004 | All | All |
| Application | Ibm | Cloud Pak For Business Automation | 25.0.0 | - | All | All |
| Application | Ibm | Cloud Pak For Business Automation | 25.0.0 | interim_fix_001 | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | IBM | Cloud Pak For Business Automation | affected 25.0.0 | Not specified |
| CNA | IBM | Cloud Pak For Business Automation | affected 24.0.1 | Not specified |
| CNA | IBM | Cloud Pak For Business Automation | affected 24.0.0 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.ibm.com/support/pages/node/7249999 | [email protected] | www.ibm.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Solutions
CNA: Remediation/Fixes IBM strongly recommends addressing the vulnerability now. Product(s) Version(s) number and/or range Remediation/Fix/Instructions IBM Business Automation Insights 25.0.0 Apply security fix 25.0.0-IF002 IBM Business Automation Insights 24.0.1 Apply security fix 24.0.1-IF005 IBM Business Automation Insights 24.0.0 Apply security fix 24.0.0-IF005
Workarounds
CNA: Workarounds and Mitigations None.
There are currently no legacy QID mappings associated with this CVE.