IBM watsonx.data CVE-2025-36324

Exploitation requires a valid authenticated account on IBM watsonx.data intelligence with at least low-privilege access (confirmed by CVSS PR:L). The vulnerability is reachable over the network (AV:N) with no special protocol, feature flag, or non-default configuration stated as a prerequisite in the available description. Limiting factors include: (1) the attacker must possess or obtain valid credentials before triggering the SSRF; (2) scope is unchanged (S:U), so impact is confined to resources reachable from the watsonx.data server's network position; (3) no integrity or availability impact is confirmed - exploitation yields only partial confidentiality exposure (C:L) such as internal IP enumeration or metadata retrieval. Unauthenticated external attackers cannot directly exploit this flaw.

The CVSS base score of 4.3 (Medium) accurately reflects a moderate-priority finding. The PR:L requirement meaningfully reduces real-world risk: an attacker must first obtain authenticated access to the platform before exploiting this flaw. The attack vector is network-based (AV:N) with low complexity (AC:L), meaning exploitation is straightforward for anyone already authenticated. Scope is unchanged (S:U), limiting blast radius to the server's own network position. No EPSS score was provided in source data, so probabilistic exploitation likelihood cannot be quantified. No KEV listing exists, and no public POC has been identified, suggesting this is not currently being exploited at scale. The most realistic threat model is an insider threat or a compromised account using SSRF to map internal cloud or on-premises resources otherwise inaccessible from the attacker's position - a meaningful risk in enterprise AI platform environments where watsonx.data may have privileged network access to data lakes and internal APIs.

An authenticated watsonx.data intelligence user submits a crafted API request containing an attacker-controlled URL targeting an internal resource - such as a cloud metadata endpoint or an internal microservice - causing the watsonx.data server to issue the request on their behalf and potentially returning response data. No public exploit code has been identified at time of analysis, so exploitation requires manual construction of the crafted request. The low attack complexity (AC:L) means that once the vulnerable endpoint is identified, exploitation is straightforward for a determined authenticated insider or attacker with stolen credentials.