IBM Integrated Analytics System CVE-2025-36290

Exploitation requires the attacker to achieve a man-in-the-middle position on the network path between the IBM Integrated Analytics System and a remote TLS endpoint it communicates with - typically through ARP spoofing, DNS poisoning, BGP hijacking, a rogue access point, or a compromised network device. This network-positioning prerequisite (reflected as AC:H in the CVSS vector) is the primary limiting factor and makes opportunistic, remote-only exploitation infeasible. No authentication is required from the attacker per the CVSS PR:N rating. All versions from 1.0.0.0 through 1.0.31.0 are affected regardless of specific configuration; no special feature flag or non-default setting is cited in the description as a prerequisite. Exploitation is limited solely to confidentiality - data modification or service disruption is not indicated by available data.

The CVSS 5.9 (Medium) score with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N is internally consistent with the description: the High attack complexity (AC:H) accurately reflects the non-trivial network-positioning prerequisite required for man-in-the-middle exploitation, which is the primary constraint limiting real-world risk. No EPSS probability, SSVC assessment, or POC data was provided in the available intelligence, making quantitative exploitation likelihood estimation impossible. No CISA KEV listing is present, and no public exploit has been identified. The confidentiality impact is rated High, meaning successful exploitation could expose the full content of intercepted sessions. The practical risk is elevated for deployments where the analytics system communicates over shared or untrusted network infrastructure - a mid-sized IT environment without network segmentation faces materially higher exposure than one with dedicated, isolated back-end connectivity. The absence of integrity and availability impact (I:N/A:N) limits the worst-case outcome to data disclosure rather than data manipulation or service disruption.

An attacker with logical network adjacency - achieved via ARP spoofing, DNS poisoning, or a compromised network device - intercepts a TLS connection initiated by the IBM Integrated Analytics System. Because the system accepts the attacker's forged certificate without validation, the attacker decrypts and reads sensitive data exchanged between the analytics platform and its backend. No public POC has been identified; achieving the required network position remains the principal technical barrier.