What is the CVSS score of CVE-2025-14912?

CVE-2025-14912 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of IBM are affected by CVE-2025-14912?

Organizations using IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 should be aware of moderate risk from CVE-2025-14912, a server-side request forgery vulnerability rated CVSS 5.4.. A patch is available.

How to fix or mitigate CVE-2025-14912?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

IBM CVE-2025-14912

EUVD-2025-209019 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-25 ibm

GHSA-7wgc-jm2p-f23w

IBM SSRF

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 25, 2026 - 20:32 euvd

EUVD-2025-209019

Analysis Generated

Mar 25, 2026 - 20:32 vuln.today

Patch released

Mar 25, 2026 - 20:32 nvd

Patch available

CVE Published

Mar 25, 2026 - 20:13 nvd

MEDIUM 5.4

DescriptionCVE.org

IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

AnalysisAI

IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 contain a server-side request forgery (SSRF) vulnerability that allows authenticated attackers to send unauthorized requests from the vulnerable system. This enables network enumeration, lateral movement, or facilitation of secondary attacks against internal or external resources. The vulnerability requires valid credentials to exploit but carries moderate real-world risk given the CVSS 5.4 score and the authenticated attack vector.

Technical ContextAI

The vulnerability is classified as CWE-918 (Server-Side Request Forgery), a design flaw where the application fails to properly validate or sanitize user-supplied input before making outbound HTTP/network requests on behalf of the server. IBM InfoSphere Information Server (affected CPE: cpe:2.3:a:ibm:infosphere_information_server:*:*:*:*:*:*:*:*) is a data integration and governance platform that processes, moves, and manages data across heterogeneous systems. The SSRF flaw likely exists in components responsible for data source connectivity, HTTP-based integrations, or remote resource access. An attacker with valid authentication credentials can manipulate request parameters to redirect the server into making connections to internal network services, cloud metadata endpoints, or external systems otherwise inaccessible from the attacker's perspective.

RemediationAI

Apply the security patch provided by IBM via their support portal at https://www.ibm.com/support/pages/node/7266698; upgrade to the earliest available patched version beyond 11.7.1.6. Until patching is feasible, implement network-level controls by restricting outbound traffic from InfoSphere servers to explicitly whitelisted internal and external destinations, and disable or restrict features that enable dynamic remote connections. Enforce strict authentication and logging on InfoSphere administrative interfaces to reduce insider risk and detect abuse. Deploy a Web Application Firewall (WAF) or reverse proxy in front of InfoSphere to inspect and block requests with suspicious URL patterns or parameters indicative of SSRF payloads (e.g., localhost, 127.0.0.1, 169.254.169.254, or internal IP ranges in request parameters).