InfoSphere Information Server
CVE-2025-33003
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain non-root access inside container
-
ExploitIdentify over-privileged component
-
ExecutionAbuse unnecessary privileges/capabilities
-
ImpactEscalate to higher privileges in container
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Unnecessary privilege execution
|
| Exploitation Conditions | Exploitation requires the attacker to already have an authenticated non-root user session executing inside an InfoSphere Information Server container (PR:L, AV:L); it is not remotely reachable. The root cause is a component running with unnecessary privileges/capabilities, so escalation succeeds only where that over-privileged execution context is present in the deployed 11.7.0.0-11.7.1.6 build. Limiting factors: no network exploitability, a valid low-privileged foothold is a prerequisite, and impact is bounded to the container scope (S:U) rather than the underlying host. |
| Impact | This is a local privilege-escalation flaw (CWE-250, Execution with Unnecessary Privileges) in IBM InfoSphere Information Server 11.7.0.0-11.7.1.6. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) consistently signals a locally-exploitable, low-complexity issue requiring an already-authenticated low-privileged (non-root) user inside the container, with high confidentiality, integrity, and availability impact confined to the container (S:U). All signals agree internally - there is no network vector and no scope change to the host, so the 7.8 'High' reflects a serious but access-gated issue rather than a remotely-wormable one. No EPSS score, CISA KEV listing, or public POC was supplied in the input, so there is no evidence of active or probable exploitation; the real-world urgency is therefore materially lower than the raw 7.8 suggests. In short: a legitimate priority for hardening environments where untrusted or low-trust users already have container-level access, but not a drop-everything internet-facing emergency absent any exploitation signal. |
| Exploit ScenarioDerived | An attacker who already holds a non-root account inside an InfoSphere Information Server container (e.g., a low-privileged application user or a compromised service account) leverages a component that runs with unnecessary privileges/capabilities to escalate to higher privileges within that container. No public exploit code was identified at time of analysis, and because the attack vector is local (AV:L) the attacker must first obtain in-container execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Local privilege escalation in IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 lets an authenticated non-root user who already has a session inside an affected container raise their privileges and capabilities within that container's scope. The root cause is a component executing with unnecessary privileges (CWE-250); the flaw is not network-reachable and requires a pre-existing low-privileged foothold in the deployed product to succeed. Impact is bounded to the container rather than the underlying host, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
RemediationAI
Patch availability is not confirmed by the supplied data; consult IBM's advisory at https://www.ibm.com/support/pages/node/7246684 for the fixed 11.7.x build and apply the latest 11.7.1.x maintenance level as soon as IBM publishes it. Until a fix is deployed, focus on reducing the over-privileged execution context that enables the escalation: run InfoSphere containers as a non-root user, drop unnecessary Linux capabilities (for example --cap-drop=ALL, adding back only what the component genuinely requires rather than using --privileged or granting CAP_SYS_ADMIN), enable user namespaces, mount the root filesystem read-only where the product tolerates it, and apply seccomp/AppArmor profiles that block privilege-changing operations such as setuid, setgid and capset. Trade-offs: aggressively dropping capabilities or forcing a read-only root filesystem can break InfoSphere services that legitimately write to mounted volumes or require specific capabilities, so validate changes in staging first, and note that access to the container runtime socket (for example mounting /var/run/docker.sock) should be removed but may disrupt management tooling. Because exploitation requires a valid non-root foothold inside the container, tightening who can obtain such a session - strict RBAC, hardened images, and controlled console/SSH access - directly shrinks the attack surface.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue maps to CWE-250 (Execution with Unnecessary Privileges): a process or component inside the InfoSphere Information Server container runs with more privileges or Linux capabilities than its function requires, giving an attacker who already operates as a non-root user inside that container a path to elevate to higher effective privilege. The affected CPE is cpe:2.3:a:ibm:infosphere_information_server:*:*:*:*:*:*:*:*, i.e. the base product, with the advisory narrowing the scope to builds 11.7.0.0 through 11.7.1.6. The assessed vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the attack is local to the container, needs low privileges, is trivially accomplished once that foothold exists (AC:L), and that the security scope does not cross into the host (S:U) - so the confidentiality, integrity and availability impact is high but confined to the containerized environment.
Know when Infosphere Information Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local, authenticated non-root foothold required (AV:L, PR:L), low complexity, and full compromise confined to the container with no scope change (S:U), yielding C:H/I:H/A:H.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow a non-root user to gain higher privileges/capabilities within the scope of a container due to execution with unnecessary privileges.
Executive ViewAI
IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 contain a local privilege escalation vulnerability that allows a user with existing low-privileged access within a container to gain elevated privileges within that same container. While the impact is confined to the container and does not extend to the host, successful exploitation could lead to unauthorized access to sensitive data, configuration changes, or service disruption within the affected container. Given that no vendor-released patch is identified at time of analysis and no public exploit identified at time of analysis, organizations should prioritize mitigation to protect data integrity and confidentiality.
No vendor-released patch identified at time of analysis. Interim mitigations include enforcing least privilege within containers, removing unnecessary capabilities from the affected component, restricting interactive access to trusted users, and monitoring for privilege escalation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Affected Products (CPE)NVD
IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. Rated critical severity (CVSS 9.8), this vulnerab
IBM InfoSphere Information Server 11.7 is affected by a remote code execution vulnerability due to insecure deserializat
IBM InfoSphere DataStage 11.7 is vulnerable to a command injection vulnerability due to improper neutralization of speci
"IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. Rated critical severity (CVSS 9.8),
IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. Rated critical severity (CVSS 9.8), this vulnerab
Untrusted search path vulnerability in InfoSphere Import Export Manager 8.1 through 9.1 in InfoSphere Information Server
IBM InfoSphere Information Server 9.1, 11.3, and 11.5 is vulnerable to a XML External Entity Injection (XXE) attack when
XML external entity injection in IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 lets remote attackers who c
"IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing X
IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XM
IBM InfoSphere 11.7.0.0 through 11.7.1.6 Information Server could allow an authenticated user to execute arbitrary comma
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to exec
GitHub PoC
Exploit-DB