What is the CVSS score of CVE-2025-36290?

CVE-2025-36290 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2025-36290?

Yes, a patch is available for CVE-2025-36290. Update the affected software to the latest version immediately.

IBM Integrated Analytics System CVE-2025-36290

EUVD-2025-210809 MEDIUM

Improper Certificate Validation (CWE-295)

2026-08-28 ibm

GHSA-cc37-cfqh-jjwr

Information Disclosure IBM Integrated Analytics System

5.9

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

MitM network positioning required (AC:H/AV:N); no attacker authentication; impact confined to confidentiality of intercepted data.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 28, 2026 - 22:42 vuln.today

DescriptionCVE.org

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.

AnalysisAI

IBM Integrated Analytics System versions 1.0.0.0 through 1.0.31.0 fails to properly validate TLS certificates, enabling network-positioned attackers to conduct man-in-the-middle attacks and intercept sensitive data in transit. IBM has confirmed the issue and released a patch via advisory node/7285149. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the network-accessible attack vector with no authentication requirement raises the relevance for deployments where the system communicates across untrusted network segments.

Technical ContextAI

CWE-295 (Improper Certificate Validation) describes a class of flaws where software neglects to authenticate the identity of a remote endpoint during TLS negotiation - either by skipping certificate chain verification, ignoring hostname mismatches, or accepting self-signed certificates without pinning. IBM Integrated Analytics System is a data analytics platform; when it establishes TLS sessions with backend services or remote APIs, the certificate presented by the remote party is not properly validated, meaning an attacker who can interpose themselves on the network path can present a forged certificate that the system accepts. The affected CPE is cpe:2.3:a:ibm:integrated_analytics_system:*:*:*:*:*:*:*:*, covering the entire 1.0.x release line from 1.0.0.0 through 1.0.31.0.

RemediationAI

Apply the vendor-supplied patch referenced in IBM security advisory https://www.ibm.com/support/pages/node/7285149. The exact remediated version number is not independently confirmed from available input data and must be verified directly with IBM or via the advisory page. As a compensating control prior to patching, restrict network paths used by the Integrated Analytics System to isolated, trusted segments - eliminating exposure over shared WAN, public internet, or multi-tenant networks removes the network-positioning opportunity an attacker requires. Where the platform supports it, certificate pinning or mutual TLS with strict hostname verification can serve as an additional layer of defense, though reconfiguration may be required and could affect connectivity to legitimate endpoints if not carefully managed.