CVE-2025-36094 — Improper Validation of Specified Quantity in Input in IBM Cloud PAK FOR Business Automation

CWE-1284 — Improper Validation of Specified Quantity in Input3 documents3 sources
Severity
8.1HIGHNVD
CNA5.4
EPSS
0.1%
top 78.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Cloud PAK FOR Business Automation
Timeline
PublishedFeb 3
Latest updateFeb 4

Description

IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 007 could allow an authenticated user to cause a denial of service or corrupt existing data due to the improper validation of input length.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HExploitability: 2.8 | Impact: 5.2

Affected Packages2 packages

▶CVEListV5ibm/cloud_pak_for_business_automation25.0.0 — 25.0.0 Interim Fix 002+2
▶NVDibm/cloud_pak24.0.0, 24.0.1, 25.0.0+2

🔴Vulnerability Details

2
GHSA
GHSA-gmrh-wfm2-3fp2: IBM Cloud Pak for Business Automation 25↗2026-02-04
▶
CVEList
Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for January 2026.↗2026-02-03
▶
CVE-2025-36094 — IBM vulnerability | cvebase