Integrated Analytics System CVE-2025-36271

Exploitation requires the attacker to occupy an on-path or network interception position relative to IBM Integrated Analytics System traffic - this is the primary limiting factor reflected in AC:H. The CVSS PR:N metric confirms no authentication to IBM IAS itself is required; however, gaining the required network vantage point may involve compromising intermediate infrastructure. No special IAS feature, configuration toggle, or deployment mode is identified in the available data as required or as a limiting condition - the vulnerability appears to be present in the default cryptographic implementation across all versions 1.0.0.0 through 1.0.31.0. Exploitation is limited to confidentiality impact only; integrity and availability are unaffected per the CVSS vector.

The CVSS 5.9 Medium score is driven primarily by AC:H, which significantly reduces exploitability - an attacker must achieve a network-interception or on-path position before leveraging the cryptographic weakness. No KEV listing and no publicly available proof-of-concept are present in the available data, indicating no confirmed or widespread active exploitation at time of analysis. EPSS data was not provided, so automated exploitation probability cannot be assessed. The real-world risk is conditional on both the attacker's ability to intercept network traffic and the sensitivity of data traversing IBM IAS channels. Organizations with IAS deployments handling regulated or classified data should treat this as a higher priority despite the moderate CVSS, given the High confidentiality impact metric. The discrepancy between CWE-759 (hashing) and the description's reference to decryption introduces uncertainty about the precise cryptographic failure mode - defenders should consult IBM's advisory directly to understand whether the flaw is in encryption, key management, or hashing.

An attacker with access to network traffic between IBM IAS nodes or between clients and the IAS system - for example via a rogue switch, compromised router, or insider network access - captures encrypted data in transit. Using the known weakness in the cryptographic algorithm employed by IAS, the attacker decrypts the intercepted payload offline and recovers highly sensitive analytic or system data. No public exploit tool is known at time of analysis.