Planning Analytics Local CVE-2025-36437

Exploitation requires valid low-privilege authenticated access to an IBM Planning Analytics Local instance (CVSS PR:L), versions 2.1.0 through 2.1.15, reachable over the network (AV:N). The description does not name a specific feature, protocol, or non-default configuration setting that must be enabled - the disclosure appears to stem from the product revealing sensitive server architecture information (consistent with CWE-209 verbose error/response behavior) during normal authenticated interaction. Limiting factors: the attacker must first obtain credentials (no unauthenticated path), the impact is confined to low-severity information disclosure with no direct integrity or availability effect, and the leaked data is useful only as a precursor to further attacks rather than granting direct access.

This is a low-to-moderate priority issue that scores CVSS 4.3 (Medium) and the real-world signals reinforce that it is NOT an urgent priority. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) describes a network-reachable but authenticated (PR:L) information-disclosure flaw with only low confidentiality impact and no integrity or availability impact - consistent with CWE-209 (information exposure through an error message or response that reveals server architecture details). The EPSS score of 0.21% (11th percentile) indicates a very low modeled probability of exploitation, and the vulnerability is NOT listed in CISA KEV and has no public exploit code identified. All signals are aligned and non-conflicting: there is no high-CVSS-vs-low-risk tension here - this is genuinely a modest, info-leak weakness most valuable as a reconnaissance aid feeding later attacks rather than a standalone threat. No SSVC decision data was provided in the input, so exploitation/automatable/technical-impact framing cannot be independently stated. The one caveat: PR:L requires the attacker to already hold valid (low-privilege) credentials to the Planning Analytics instance, which meaningfully limits exposure versus a fully unauthenticated flaw.

An attacker who already holds low-privileged authenticated access to an IBM Planning Analytics Local instance (versions 2.1.0-2.1.15) interacts with the application in a way that returns verbose error or response data disclosing underlying server architecture details. The attacker harvests this leaked information to fingerprint the environment and plan a more targeted follow-on attack. No public proof-of-concept exploit code was identified, and exploitation requires valid credentials (PR:L), limiting the realistic attacker population.