{"api_version":"1","generated_at":"2026-11-08T13:24:25+00:00","cve":"CVE-2025-36421","urls":{"html":"https://cve.report/CVE-2025-36421","api":"https://cve.report/api/cve/CVE-2025-36421.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-36421","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-36421"},"summary":{"title":"Multiple vulnerabilities in IBM Controller","description":"IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques.","state":"PUBLISHED","assigner":"ibm","published_at":"2026-09-18 16:17:03","updated_at":"2026-10-14 13:10:00"},"problem_types":["CWE-319","CWE-319 CWE-319 Cleartext Transmission of Sensitive Information"],"metrics":[{"version":"3.1","source":"psirt@us.ibm.com","type":"Secondary","score":"5.9","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"5.9","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://www.ibm.com/support/pages/node/7287970","name":"https://www.ibm.com/support/pages/node/7287970","refsource":"psirt@us.ibm.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-36421","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-36421","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"IBM","product":"Controller","version":"affected 11.0.0 11.0.1 FP7 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"Controller","version":"affected 11.1.0 11.1.3 FP1 semver","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"It is strongly recommended that you apply the most recent security updates:\n\n\n\n\n\n\n\nAffected Product(s)Version(s)FixIBM Cognos Controller11.0.0 - 11.0.1 FP7 https://www.ibm.com/mysupport . Customers currently running IBM Controller 11.0 and 11.1 can upgrade to the 11.2 release stream at no additional charge.","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2025","cve_id":"36421","cve":"CVE-2025-36421","epss":"0.002030000","percentile":"0.105940000","score_date":"2026-09-21","updated_at":"2026-09-22 00:03:17"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2025-36421","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-19T13:45:03.739556Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-09-19T14:21:50.487Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"cpes":["cpe:2.3:a:ibm:controller:11.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:controller:11.0.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:controller:11.1.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:controller:11.1.3:*:*:*:*:*:*:*"],"product":"Controller","vendor":"IBM","versions":[{"lessThanOrEqual":"11.0.1 FP7","status":"affected","version":"11.0.0","versionType":"semver"},{"lessThanOrEqual":"11.1.3 FP1","status":"affected","version":"11.1.0","versionType":"semver"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques.</p>"}],"value":"IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques."}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-319","description":"CWE-319 Cleartext Transmission of Sensitive Information","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-18T15:44:27.068Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7287970"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<div><div><div><div>It is strongly recommended that you apply the most recent security updates:</div></div></div></div><div><table><tbody><tr><td><strong>Affected Product(s)</strong></td><td><strong>Version(s)</strong></td><td><strong>Fix</strong></td></tr><tr><td>IBM Cognos Controller</td><td>11.0.0 - 11.0.1 FP7</td><td><a href=\"https://www.ibm.com/software/passportadvantage/pao-customer\" rel=\"nofollow\">Download IBM Controller 11.1.0 from Passport Advantage</a></td></tr><tr><td>IBM Controller</td><td>11.1.0 - 11.1.3 FP1</td><td><a href=\"https://www.ibm.com/software/passportadvantage/pao-customer\" rel=\"nofollow\">Download IBM Controller 11.2.0 from Passport Advantage</a></td></tr></tbody></table></div><p><br/>IBM Controller 11.2.0  is available for Cloud deployments. To schedule an upgrade to this release for either your non-production or production environment, log a support case at <a href=\"https://www.ibm.com/mysupport\" rel=\"nofollow\">https://www.ibm.com/mysupport</a>. Customers currently running IBM Controller 11.0 and 11.1 can upgrade to the 11.2 release stream at no additional charge.<br/></p>"}],"value":"It is strongly recommended that you apply the most recent security updates:\n\n\n\n\n\n\n\nAffected Product(s)Version(s)FixIBM Cognos Controller11.0.0 - 11.0.1 FP7 https://www.ibm.com/mysupport . Customers currently running IBM Controller 11.0 and 11.1 can upgrade to the 11.2 release stream at no additional charge."}],"title":"Multiple vulnerabilities in IBM Controller"}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2025-36421","datePublished":"2026-09-18T15:44:27.068Z","dateReserved":"2025-04-15T21:17:02.754Z","dateUpdated":"2026-09-19T14:21:50.487Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-18 16:17:03","lastModifiedDate":"2026-10-14 13:10:00","problem_types":["CWE-319","CWE-319 CWE-319 Cleartext Transmission of Sensitive Information"],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-19T13:45:03.739556Z","id":"CVE-2025-36421","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"36421","Ordinal":"1","Title":"Multiple vulnerabilities in IBM Controller","CVE":"CVE-2025-36421","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"36421","Ordinal":"1","NoteData":"IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques.","Type":"Description","Title":"Multiple vulnerabilities in IBM Controller"}]}}}