IBM CP4BA CVE-2025-36093

Exploitation requires the attacker to first obtain a man-in-the-middle position on the network path between a client and the Cloud Pak for Business Automation service - this is the concrete prerequisite and the reason CVSS rates attack complexity HIGH. No service-side authentication is required (PR:N) and no user interaction (UI:N), but the MITM positioning requirement (e.g., adjacency to the network segment, ability to intercept/relay TLS or application traffic) is the primary limiting factor; purely remote off-path attackers cannot trigger it. Affected deployments are IBM Cloud Pak for Business Automation versions 24.0.0, 24.0.1, and 25.0.0 (including listed interim fixes), so unpatched installations on these release lines are in scope.

This is a genuinely moderate-priority issue rather than a top-tier emergency, and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, score 7.4) describes a network-reachable, unauthenticated flaw with HIGH attack complexity and no availability impact - the complexity is high precisely because exploitation requires a man-in-the-middle position on the network path, which is a meaningful barrier. CWE-602 (client-side enforcement of server-side security) aligns with the MITM/improper-access-control narrative. The exploitation signals all point low: EPSS is only 0.06% (18th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, so there is no public exploit identified at time of analysis and no evidence of active exploitation. No signals conflict here - a high-complexity, MITM-dependent flaw with low EPSS and no KEV is a coherent picture of a real but situational vulnerability, not a mass-exploited one. The 'Authentication Bypass' tag slightly overstates the mechanism: the description is about improper access controls exploitable via MITM, not a direct auth-bypass primitive - treat that tag label with caution.

An attacker who can position themselves on the network path between a client and the IBM Cloud Pak for Business Automation service (for example via ARP spoofing, rogue Wi-Fi, or a compromised intermediary) intercepts and manipulates traffic to exploit the improper access controls, reading unauthorized content or performing unauthorized actions. No public exploit identified at time of analysis, so any attack would require custom tooling. The HIGH attack complexity reflects the prerequisite of achieving and sustaining that privileged network position.