InfoSphere Information Server
CVE-2025-12531
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach XML-processing endpoint over network
-
ExploitSubmit XML with external entity payload
-
ExecutionParser resolves external/parameter entity
-
ImpactExfiltrate sensitive file contents or exhaust memory
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A02:2025 - Security Misconfiguration
ASVS 5.0
V13 - Configuration XML external entity prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to reach an InfoSphere Information Server component that accepts and parses attacker-supplied XML data with an XML parser that has external-entity resolution enabled (the default-unsafe configuration CWE-611 describes). Affected versions are 11.7.0.0 through 11.7.1.6. Per IBM's CVSS vector (PR:N/UI:N), no authentication or user interaction is stated to be required; the practical limiting factor is network exposure of the specific XML-handling endpoint, which in many InfoSphere deployments sits behind an authenticated console or internal network boundary - verify endpoint reachability in your deployment, as this materially changes real-world risk. |
| Impact | This is a genuinely serious flaw on paper but likely a measured rather than emergency priority. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with high confidentiality (C:H) and high availability (A:H) impact and no integrity impact - consistent with a classic XXE (CWE-611) enabling file/SSRF-style data disclosure and memory-exhaustion denial of service. However, the exploitation-probability signals are modest: EPSS is only 0.22% (44th percentile), there is no CISA KEV listing (no public exploit identified at time of analysis), and no public exploit code was referenced. The low EPSS alongside a 9.1 CVSS indicates a high-severity-but-not-yet-actively-exploited issue typical of freshly disclosed enterprise software bugs, so the near-term real-world threat is lower than the score alone suggests. Note a tension worth verifying: the single reference is only the IBM support advisory landing page, and no SSVC decision data (exploitation/automatable/technical-impact) was provided, so the 'remote unauthenticated' framing rests entirely on IBM's own vector - confirm whether the vulnerable XML-processing endpoint is actually exposed without authentication in a default deployment, since many InfoSphere components sit behind authenticated consoles. |
| Exploit ScenarioDerived | A remote attacker submits XML data containing a malicious external entity reference to an InfoSphere Information Server component that parses XML without disabling external entities. The parser resolves the entity, allowing the attacker to read sensitive local files or trigger uncontrolled memory consumption (DoS). No public exploit code was identified, but XXE is a well-understood, easily weaponized bug class. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 18, 2026
XML external entity injection in IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 lets remote attackers who can reach an XML-parsing endpoint read arbitrary files from the server's filesystem and exhaust memory until services degrade or crash. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/A:H, I:N) rates 9.1 and implies no authentication or user interaction is required, although real-world exposure hinges on whether the vulnerable XML ingestion path sits behind an authenticated console or an internal network boundary. No public exploit code or CISA KEV listing is associated with this CVE at time of analysis, and EPSS is 0.22% (44th percentile), so this is a genuinely serious flaw on paper but likely a measured rather than emergency priority.
Earlier versions of this analysis (1)
IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
RemediationAI
Apply the IBM fix for the 11.7.x stream documented at https://www.ibm.com/support/pages/node/7249881 - the intelligence provided does not name an exact fixed version, so confirm the target fix pack or interim fix level against that advisory before upgrading rather than assuming a version number; upgrade all InfoSphere Information Server nodes, not just the front-end, since parsing may occur in back-end services. Where patching must wait, the highest-value compensating control is to place the XML-handling endpoints behind a reverse proxy or WAF rule that rejects requests containing a DOCTYPE declaration or external entity references, accepting that any legitimate workflow relying on DTD-validated XML will break and need an exception path. Harden the parser configuration itself (enable FEATURE_SECURE_PROCESSING, set disallow-doctype-decl to true, and disable external general and parameter entities) if the deployment exposes such settings, with the trade-off that DTD-based imports will fail. Constrain blast radius by running InfoSphere services under least-privilege OS accounts that cannot read unrelated configuration or credential files, and restrict outbound network egress from the servers so external entity fetches cannot reach internal hosts - this may disrupt intended integrations and should be scoped to the affected hosts. Finally, cap XML request size and enforce JVM/container heap limits to blunt the memory-exhaustion vector, and alert on oversized XML payloads or DOCTYPE-bearing requests as a detection signal while remediation is in progress.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-611 (Improper Restriction of XML External Entity Reference): an XML parser used by InfoSphere Information Server processes attacker-supplied documents with DTD processing and external entity resolution enabled. When a crafted document declares a SYSTEM identifier, the parser dereferences it, allowing local file disclosure via file:// URIs (configuration files, credential stores, connection strings) and, where http/https identifiers are honored, outbound requests that can be used for internal reconnaissance or SSRF-style probing. Memory consumption (the A:H component of the vector) comes from entity-expansion techniques such as recursive internal entity definitions or very large external entity payloads, which are cheap to send and can exhaust heap in the Java-based services that make up the platform. The CPE cpe:2.3:a:ibm:infosphere_information_server:*:*:*:*:*:*:*:* is version-wildcarded, with the affected range bounded by IBM's advisory as 11.7.0.0 through 11.7.1.6. The integrity impact is rated None (I:N), consistent with a read/exhaust primitive rather than data modification; the practical limiting factor is reachability of an endpoint that accepts and parses XML, and in many deployments such metadata-import, configuration-exchange, or web-service interfaces are fronted by an authenticated console or confined to an internal network segment.
Know when Infosphere Information Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Network-reachable XML parser exploitable without auth or interaction (AV:N/AC:L/PR:N/UI:N); XXE discloses sensitive data (C:H) and enables memory-exhaustion DoS (A:H), with no integrity impact (I:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
Executive ViewAI
IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 has a critical, unauthenticated XML external entity weakness that could allow an attacker who can reach an XML-parsing endpoint to read server files and cause service degradation or outages. The affected platform supports data integration and information governance workflows, so disruption could ripple into dependent reporting and operational processes; however, no public exploit identified at time of analysis and no CISA KEV listing, so priority should be driven by whether the vulnerable endpoint is externally reachable or sits behind strong internal controls. Leadership should care because no vendor-released patch identified at time of analysis, making containment and exposure reduction the primary risk levers.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to XML-parsing endpoints and avoid internet exposure; enforce authentication, authorization, and least privilege on any fronting console; disable external entity and DTD processing in the XML parser where supported; deploy WAF or XML-filtering rules for XXE patterns; apply rate limiting and memory limits to reduce denial-of-service risk; monitor and alert on malformed XML, unexpected file reads, and service crashes; and engage IBM for mitigation guidance and patch timing.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
XML External Entity (XXE) attacks exploit XML parsers that process Document Type Definitions (DTDs) without proper restrictions.
Affected Products (CPE)NVD
IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. Rated critical severity (CVSS 9.8), this vulnerab
IBM InfoSphere Information Server 11.7 is affected by a remote code execution vulnerability due to insecure deserializat
IBM InfoSphere DataStage 11.7 is vulnerable to a command injection vulnerability due to improper neutralization of speci
"IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. Rated critical severity (CVSS 9.8),
IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. Rated critical severity (CVSS 9.8), this vulnerab
Untrusted search path vulnerability in InfoSphere Import Export Manager 8.1 through 9.1 in InfoSphere Information Server
IBM InfoSphere Information Server 9.1, 11.3, and 11.5 is vulnerable to a XML External Entity Injection (XXE) attack when
"IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing X
IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XM
IBM InfoSphere 11.7.0.0 through 11.7.1.6 Information Server could allow an authenticated user to execute arbitrary comma
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to exec
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to exec
GitHub PoC
Exploit-DB