IBM CVE-2025-36258

The CVSS vector AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N indicates local attack vector with low complexity, requiring no privileges or user interaction, with scope change and high confidentiality impact. While the 7.1 score is high, the real-world risk is moderated by the local access requirement - an attacker must already have access to the system. However, the PR:N (no privileges required) and scope change elements elevate concern, as a low-privileged local user could potentially access credentials for privileged accounts or other systems. The absence of EPSS score data, KEV listing, or public proof-of-concept suggests this is not currently being actively exploited in the wild. Priority should be medium-to-high for organizations running InfoSphere Information Server in multi-user environments where untrusted users may have local access, but lower for isolated single-tenant deployments with strict access controls.

An attacker with local access to a server running InfoSphere Information Server (such as a contractor, compromised service account, or user on a shared system) navigates to the application's installation directory and examines configuration files or data stores. Without requiring elevated privileges, the attacker reads plaintext credentials for database connections, service accounts, or administrative users, then leverages these credentials to access connected databases, compromise other integrated systems, or escalate privileges within the InfoSphere environment itself.