Cloud Pak Cyclops CVE-2025-36221

The vulnerability requires the target to be running IBM Cloud Pak for Data System Cyclops in the version range 11.3.0.2 through Interim Fix 002 with default manufacturing credentials still active - specifically credentials that IBM ships for use during the installation and provisioning process and which have not been subsequently rotated. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no special conditions beyond network reachability: unauthenticated remote exploitation against an exposed management interface of an unpatched instance. Exploitation is limited by: (1) the management interface being network-accessible rather than isolated to a management VLAN - organizations with properly segmented Cyclops management networks significantly reduce remote exploitation risk; (2) default credentials having been rotated post-installation - any deployment that enforced credential rotation as part of its security hardening baseline is not vulnerable; and (3) the specific version range - deployments running versions outside 11.3.0.2 through Interim Fix 002 are not confirmed affected.

Despite the medium CVSS base score of 5.3, real-world risk is nuanced. The attack vector is fully network-accessible with no authentication or user interaction required, which is high-severity in operational terms. However, several signals moderate the urgency: EPSS at 0.03% (11th percentile) suggests very low observed or predicted exploitation probability; SSVC records exploitation as 'none' as of analysis; and the integrity impact is rated 'partial' rather than 'total', limiting the blast radius. The SSVC 'Automatable: yes' flag is the most concerning signal - scripted scanning for IBM Cyclops installations followed by default-credential login attempts requires minimal attacker sophistication and could be incorporated into mass-scanning campaigns without high investment. There is no CVSSv3 confidentiality impact recorded, which may understate risk: authentication bypass in an appliance platform often grants access to configuration interfaces that could indirectly expose sensitive data not modeled in the base score. The low EPSS and absence from CISA KEV suggest this has not been actively weaponized, but organizations with internet-exposed Cyclops management interfaces should treat this as elevated priority due to the zero-complexity exploitation path.

An external attacker scans for network-exposed IBM Cloud Pak for Data System Cyclops management interfaces and identifies a target running a version between 11.3.0.2 and Interim Fix 002. Using publicly documented IBM manufacturing default credentials, the attacker authenticates without any prior foothold, then makes unauthorized configuration changes - for example, altering data processing jobs, modifying integration settings, or creating footholds for later access. Because the process is automatable per SSVC assessment, this scenario is consistent with scripted mass-exploitation campaigns rather than targeted intrusion.