IBM FTM SWIFT CVE-2025-36148

The CVSS vector assigns PR:L, indicating the attacker requires low-level authenticated access to the IBM FTM Web UI to inject the XSS payload - however, the CVE description explicitly characterizes the attacker as unauthenticated, a direct conflict not resolved in available data that must be clarified via the IBM advisory at https://www.ibm.com/support/pages/node/7272275. A second prerequisite is victim interaction (UI:R): a separate authenticated user must browse to the page carrying the injected payload for script execution to occur. Exploitation is limited by: the need for victim user interaction with the affected Web UI page, the unresolved authentication requirement for payload injection, the constraint that the target must run IBM FTM for SWIFT Services for Multiplatforms versions 3.2.4.0 through 3.2.4.15 specifically, and the SSVC 'Automatable: no' finding confirming this cannot be reliably chained into automated mass exploitation. The absence of CISA KEV listing and SSVC 'Exploitation: none' confirm no active exploitation has been observed.

The CVSS base score of 5.4 (Medium) is bounded by two key constraints: PR:L (the attacker must hold at least low-level access to inject the payload) and UI:R (a victim user must actively interact with the affected page). EPSS at 0.05% (16th percentile) and SSVC findings of 'Exploitation: none' and 'Automatable: no' collectively indicate very low current exploitation activity and limited scalability for mass attacks. Despite these dampening signals, the Changed Scope (S:C) and the financial sector deployment context (SWIFT transaction management) materially elevate the business impact ceiling: successful credential theft from a SWIFT operator session carries consequences disproportionate to the Medium CVSS score. A critical data conflict must be flagged: the CVE description states 'unauthenticated attacker' while the CVSS vector assigns PR:L (low privileges required) - these are mutually inconsistent. If the true attack vector requires no authentication, the effective risk is higher than the scored vector implies, and the EPSS and SSVC assessments may understate the threat. Administrators should obtain clarification from IBM via the advisory at https://www.ibm.com/support/pages/node/7272275 before relying solely on the CVSS score for prioritization.

An attacker with access to the IBM FTM Web UI - whether unauthenticated or low-privileged, pending IBM clarification - injects a malicious JavaScript payload into a field that is later rendered without sanitization to an authenticated SWIFT operator. When the operator views the affected page during an active session, the script executes in their browser, exfiltrating session cookies or SWIFT credentials to an attacker-controlled endpoint. No public proof-of-concept exploit code has been identified at time of analysis, and the attack requires victim interaction (UI:R), limiting opportunistic automated exploitation.