{"api_version":"1","generated_at":"2026-09-30T09:40:34+00:00","cve":"CVE-2025-36386","urls":{"html":"https://cve.report/CVE-2025-36386","api":"https://cve.report/api/cve/CVE-2025-36386.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-36386","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-36386"},"summary":{"title":"There is a vulnerability in the IBM Maximo Manage application in IBM Maximo Application Suite for Cognos Analytics","description":"IBM Maximo Application Suite 9.0.0 through 9.0.15 and 9.1.0 through 9.1.4 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.","state":"PUBLISHED","assigner":"ibm","published_at":"2025-10-28 16:15:38","updated_at":"2026-09-26 00:10:00"},"problem_types":["CWE-305","CWE-305 CWE-305 Authentication Bypass by Primary Weakness"],"metrics":[{"version":"3.1","source":"psirt@us.ibm.com","type":"Secondary","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://www.ibm.com/support/pages/node/7249416","name":"https://www.ibm.com/support/pages/node/7249416","refsource":"psirt@us.ibm.com","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-36386","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-36386","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"IBM","product":"IBM Maximo Application Suite","version":"affected 9.0.0 9.0.15 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"IBM Maximo Application Suite","version":"affected 9.1.0 9.1.4 semver","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Remediation/Fixes IBM strongly recommends addressing the vulnerability now by upgrading to fixes from below links MAS Manage Patch Fix or Release Upgrade for MAS 9.0 Fix Central Upgrade for MAS 9.1 Fix Central","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2025","cve_id":"36386","vulnerable":"1","versionEndIncluding":"9.0.15","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"maximo_application_suite","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"36386","vulnerable":"1","versionEndIncluding":"9.1.4","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"maximo_application_suite","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2025","cve_id":"36386","cve":"CVE-2025-36386","epss":"0.005210000","percentile":"0.419570000","score_date":"2026-09-27","updated_at":"2026-09-28 00:02:20"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2025-36386","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2025-10-28T16:54:30.318336Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2025-10-28T16:57:09.538Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"cpes":["cpe:2.3:a:ibm:maximo_application_suite:9.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:maximo_application_suite:9.0.15:*:*:*:*:*:*:*","cpe:2.3:a:ibm:maximo_application_suite:9.1.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:maximo_application_suite:9.1.4:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"IBM Maximo Application Suite","vendor":"IBM","versions":[{"lessThanOrEqual":"9.0.15","status":"affected","version":"9.0.0","versionType":"semver"},{"lessThanOrEqual":"9.1.4","status":"affected","version":"9.1.0","versionType":"semver"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*","versionEndIncluding":"9.0.15","versionStartIncluding":"9.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*","versionEndIncluding":"9.1.4","versionStartIncluding":"9.1.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>IBM Maximo Application Suite 9.0.0 through 9.0.15 and 9.1.0 through 9.1.4 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.</p>"}],"value":"IBM Maximo Application Suite 9.0.0 through 9.0.15 and 9.1.0 through 9.1.4 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-305","description":"CWE-305 Authentication Bypass by Primary Weakness","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2025-10-28T15:58:50.265Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7249416"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Remediation/Fixes IBM strongly recommends addressing the vulnerability now by upgrading to fixes from below links MAS Manage Patch Fix or Release Upgrade for MAS 9.0 Fix Central Upgrade for MAS 9.1 Fix Central</p>"}],"value":"Remediation/Fixes IBM strongly recommends addressing the vulnerability now by upgrading to fixes from below links MAS Manage Patch Fix or Release Upgrade for MAS 9.0 Fix Central Upgrade for MAS 9.1 Fix Central"}],"title":"There is a vulnerability in the IBM Maximo Manage application in IBM Maximo Application Suite for Cognos Analytics","x_generator":{"engine":"ibm-cvegen"}}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2025-36386","datePublished":"2025-10-28T15:56:58.740Z","dateReserved":"2025-04-15T21:16:57.301Z","dateUpdated":"2025-10-28T16:57:09.538Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2025-10-28 16:15:38","lastModifiedDate":"2026-09-26 00:10:00","problem_types":["CWE-305","CWE-305 CWE-305 Authentication Bypass by Primary Weakness"],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-10-28T16:54:30.318336Z","id":"CVE-2025-36386","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0","versionEndIncluding":"9.0.15","matchCriteriaId":"4DF88C5A-C790-4F97-8672-A23C38D6B798"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:maximo_application_suite:*:*:*:*:*:*:*:*","versionStartIncluding":"9.1.0","versionEndIncluding":"9.1.4","matchCriteriaId":"184F8AEA-D1BE-431E-9139-06787DA73A89"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"36386","Ordinal":"1","Title":"There is a vulnerability in the IBM Maximo Manage application in","CVE":"CVE-2025-36386","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"36386","Ordinal":"1","NoteData":"IBM Maximo Application Suite 9.0.0 through 9.0.15 and 9.1.0 through 9.1.4 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.","Type":"Description","Title":"There is a vulnerability in the IBM Maximo Manage application in"}]}}}