CVE-2025-36356 — Execution with Unnecessary Privileges in IBM Security Verify Access

CWE-250 — Execution with Unnecessary Privileges3 documents3 sources
Severity
9.3CRITICALNVD
EPSS
0.0%
top 97.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
IBM Security Verify AccessIBM Security Verify Access DockerIBM Verify Identity Access+2 more
Timeline
PublishedOct 6

Description

IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could allow a locally authenticated user to escalate their privileges to root due to execution with more privileges than required.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HExploitability: 2.5 | Impact: 6.0

Affected Packages6 packages

▶NVDibm/security_verify_access_docker10.0.0.0 — 10.0.9.0+1
▶CVEListV5ibm/security_verify_access_docker10.0.0.0 — 10.0.9.0 IF2+1
▶NVDibm/security_verify_access10.0.0.0 — 10.0.9.0+1
▶CVEListV5ibm/security_verify_access_appliance10.0.0.0 — 10.0.9.0 IF2+1
▶NVDibm/verify_identity_access_docker11.0.0.0 — 11.0.1.0+1

Patches

Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-v32q-pvc7-fgqc: IBM Security Verify Access and IBM Security Verify Access Docker 10↗2025-10-06
▶
CVEList
IBM Security Verify Access privilege escalation↗2025-10-06
▶
CVE-2025-36356 — Execution with Unnecessary Privileges | cvebase