watsonx Orchestrate Cartridge CVE-2025-0165
CRITICALAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach cartridge network endpoint
-
DeliverySubmit crafted SQL in request parameter
-
ExploitInjection reaches back-end query
-
ExecutionDatabase read/write executed
-
ImpactExfiltrate or alter stored data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the watsonx Orchestrate Cartridge interface on an affected IBM Cloud Pak for Data deployment (versions 4.8.4, 4.8.5, or 5.0.0 through 5.2.0) and the ability to supply input to a request parameter that is passed to a vulnerable back-end database query. The vendor vector asserts no authentication (PR:N) and no user interaction (UI:N), but the description does not name the specific endpoint or feature, and because this cartridge is an add-on within an authenticated Cloud Pak for Data platform, real-world reachability is likely limited to actors who can reach the platform's network and possibly hold a platform session - verify exposure and auth requirement with IBM. Primary limiting factor: the component is a specialized enterprise product typically deployed inside private/managed environments rather than directly on the public internet. |
| Impact | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, base 9.8) depicts an unauthenticated, network-reachable SQL injection with full CIA impact - on paper a top-tier priority. However, the exploitation signals do not reinforce that urgency: EPSS is only 0.08% (25th percentile), the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced. The single reference is the IBM vendor advisory (node 7243596); no SSVC decision data was provided in the input. The strongest tension is between a maximal CVSS score and a very low EPSS probability, which suggests this is a credible-but-not-yet-exploited flaw rather than an actively weaponized one - typical of a newly PSIRT-disclosed enterprise issue with limited external attack surface. Note also that watsonx Orchestrate Cartridge for Cloud Pak for Data is an enterprise add-on usually deployed inside an authenticated platform, so the vendor-assigned PR:N (unauthenticated) should be verified against actual deployment topology; many Cloud Pak for Data SQLi issues are reachable only post-authentication. Treat as high-severity to patch on a normal urgent cycle, but the absence of KEV/POC/EPSS pressure means it is not an emergency drop-everything item unless the component is internet-exposed. |
| Exploit ScenarioDerived | An attacker with network access to the watsonx Orchestrate Cartridge submits a specially crafted request containing malicious SQL that is concatenated into a back-end database query, allowing them to read, insert, modify, or delete records. Because the vendor vector lists PR:N and AC:L, no authentication or user interaction is claimed to be required, lowering the barrier. No public exploit code is referenced, so an attacker would need to develop the injection payload themselves. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 18, 2026
SQL injection in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data 4.8.4, 4.8.5, and 5.0.0 through 5.2.0 allows remote attackers to view, add, modify, or delete back-end database contents. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) describes network-reachable exploitation without authentication or user interaction per the vendor vector, though real-world exposure is likely constrained because the cartridge is an add-on inside an authenticated Cloud Pak for Data platform typically deployed in private or managed environments. No public exploit identified at time of analysis and no CISA KEV entry is present; EPSS is low at 0.08% (25th percentile).
Earlier versions of this analysis (1)
IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data 4.8.4, 4.8.5, and 5.0.0 through 5.2.0 is vulnerable to SQL injection. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
RemediationAI
No exact fixed version is provided in the available data; consult the IBM advisory at https://www.ibm.com/support/pages/node/7243596 for the vendor-released fix and apply the recommended update for IBM watsonx Orchestrate Cartridge on Cloud Pak for Data 4.8.4, 4.8.5, or 5.0.0 through 5.2.0. Until a patch is applied, reduce exposure by restricting network access to the Cartridge interface to trusted management networks and authorized users, enforcing authentication and authorization at the Cloud Pak for Data platform layer, and monitoring or blocking requests containing SQL metacharacters at a web application firewall or reverse proxy; these controls can break legitimate administrative workflows and do not remove the underlying injection flaw, so they are compensating measures only. Validate the actual authentication requirement and exposed endpoints with IBM, since the CVSS vector claims PR:N but deployment context may constrain reachability.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a CWE-89 SQL injection in the watsonx Orchestrate Cartridge, an add-on component for IBM Cloud Pak for Data. CPE data identifies the affected package as ibm:watsonx_orchestrate_cartridge_for_ibm_cloud_pak_for_data with wildcard versions, matching the advisory's stated ranges 4.8.4, 4.8.5, and 5.0.0 through 5.2.0. The root cause is insufficient neutralization of special elements in SQL commands, so input that reaches a vulnerable back-end database query can alter query structure and permit read, insert, update, or delete operations against the back-end database. The CVSS vector indicates network reachability, low attack complexity, no privileges required (PR:N), and no user interaction, with high confidentiality, integrity, and availability impact; however, the specific vulnerable endpoint or request parameter is not named in the available description, and because the cartridge sits within an authenticated Cloud Pak for Data platform, actual reachability and authentication requirements should be validated against the deployment.
Know when Watsonx Orchestrate Cartridge For Ibm Cloud Pak For Data gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network SQL injection with low complexity and no stated auth/interaction yields AV:N/AC:L/PR:N/UI:N; view/add/modify/delete of DB records gives C:H/I:H/A:H, though PR:N is vendor-asserted and warrants verification.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data 4.8.4, 4.8.5, and 5.0.0 through 5.2.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
Executive ViewAI
IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data (versions 4.8.4, 4.8.5, and 5.0.0 through 5.2.0) contains a critical SQL injection flaw that could allow an attacker to view, add, modify, or delete back-end database contents, creating data confidentiality and integrity risk for organizations using the cartridge. The CVSS vector describes network-reachable, unauthenticated exploitation with high impact, although the add-on's typical placement inside an authenticated, private or managed Cloud Pak for Data environment may limit practical exposure. Leadership should prioritize inventory and containment because no vendor-released patch was identified at time of analysis and no public exploit was identified at time of analysis.
No vendor-released patch identified at time of analysis; interim mitigations include restricting network access to the cartridge, enforcing least-privilege database accounts, deploying WAF and database activity monitoring for SQL injection, reviewing logs for unauthorized data access or modification, isolating affected Cloud Pak for Data environments, and disabling non-essential cartridge features until a vendor fix is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
GitHub PoC
Exploit-DB