What is the CVSS score of CVE-2025-36271?

CVE-2025-36271 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2025-36271?

Yes, a patch is available for CVE-2025-36271. Update the affected software to the latest version immediately.

Integrated Analytics System CVE-2025-36271

EUVD-2025-210808 MEDIUM

Use of a One-Way Hash without a Salt (CWE-759)

2026-08-28 ibm

GHSA-cw84-q723-ph6m

Information Disclosure IBM Integrated Analytics System

5.9

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

Network interception required for exploitation justifies AC:H; no IAS authentication needed (PR:N); only confidentiality is impacted, matching the decryption-only nature.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 28, 2026 - 22:42 vuln.today

DescriptionCVE.org

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

AnalysisAI

IBM Integrated Analytics System versions 1.0.0.0 through 1.0.31.0 employs cryptographic algorithms below acceptable security standards, exposing highly sensitive data to decryption by a network-positioned attacker. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates network exploitation without authentication but requires high attack complexity, consistent with a passive interception or man-in-the-middle scenario. No public exploit code has been identified, and IBM has released a remediation patch via support advisory 7285147.

Technical ContextAI

The affected product is IBM Integrated Analytics System, an enterprise analytics appliance, covering all releases from 1.0.0.0 through 1.0.31.0 per CPE cpe:2.3:a:ibm:integrated_analytics_system:*:*:*:*:*:*:*:*. The assigned CWE is CWE-759 (Use of a One-Way Hash without a Salt), which describes hash functions applied without a unique salt per value, making outputs vulnerable to precomputation attacks such as rainbow tables. However, the CVE description specifically references an attacker being able to 'decrypt' sensitive information, which more typically implies weak symmetric or asymmetric encryption rather than unsalted hashing - this inconsistency between the CWE classification and the description language should be noted and verified with IBM's advisory. The CVSS confidentiality impact of High reflects that the exposed data is described as 'highly sensitive.'

RemediationAI

Apply the vendor-released patch per IBM support advisory 7285147 at https://www.ibm.com/support/pages/node/7285147. The advisory is the authoritative source for the exact remediated version, which was not specified in the available input data and should not be inferred. As a compensating control pending patch deployment, network segmentation to restrict access to IBM IAS to only trusted internal hosts reduces the attacker's ability to achieve the network interception position required by the AC:H vector - note that this does not eliminate the cryptographic weakness but significantly raises the bar for exploitation. Encrypting communications to and from IAS using an independent, strong transport layer (such as TLS 1.2+ with strong cipher suites enforced at a network boundary) may further limit exposure of sensitive data even if the internal cryptographic algorithms remain weak.