IBM Verify Directory CVE-2025-36074

Requires a pre-authenticated privileged (administrative) user account on IBM Security Verify Directory Container versions 10.0.0 through 10.0.0.3 - exploitation is not possible for unauthenticated or low-privileged actors (PR:H). The specific weakness is that the file-upload function does not validate uploaded file type (CWE-434), allowing dangerous file types to be stored. Realistic impact depends on a secondary step: the uploaded malicious file must be delivered to or retrieved by a victim to 'perform further attacks,' so full harm is contingent on downstream victim interaction rather than being self-contained. Limiting factors: the high privilege requirement, the affected packaging being the container distribution only, and the indirect delivery-vector nature of the impact.

This is a high-CVSS (7.2) but low-real-world-priority finding, and the signals are internally consistent in pointing that way. The vendor CVSS vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, but the single most important limiter is PR:H - the description explicitly states 'A privileged user could upload malicious files,' meaning the actor already holds elevated privileges on the directory system before any exploitation occurs. EPSS is negligible at 0.04% (11th percentile), SSVC from CISA scores Exploitation=none, Automatable=no, Technical Impact=partial, there is no CISA KEV listing, and no public exploit code was identified. All exploitation signals therefore align: no public exploit identified at time of analysis and no evidence of active exploitation. The C:H/I:H/A:H impact rating is arguably generous given the description frames the danger as uploaded files being 'sent to victims for performing further attacks' - i.e., the affected system acts as a staging point/delivery vector for downstream social-engineering or secondary attacks rather than a guaranteed immediate full-compromise of the directory host itself. There is a mild tension worth verifying with IBM: the CVSS asserts total CIA impact, while the prose emphasizes an indirect, victim-targeting use of the uploaded file, and SSVC Technical Impact is only 'partial' - below what C:H/I:H/A:H implies.

An attacker who has already obtained privileged (administrative) access to an IBM Security Verify Directory container instance abuses the missing file-type validation to upload a malicious file - for example a script, web content, or a booby-trapped document - into the system. That file is then distributed to or retrieved by other users/victims, enabling secondary attacks such as malware delivery or code execution in the victim's context. No public proof-of-concept exploit is known, and the attack requires pre-existing high privileges (PR:H), sharply limiting the realistic attacker pool.