Severity
High
Analysis Summary
CVE-2025-36038 CVSS:9
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects.
CVE-2025-0966 CVSS:7.6
IBM InfoSphere Information Server 11.7 vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
CVE-2025-36004 CVSS:8.8
IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user to gain elevated privileges due to an unqualified library call in IBM Facsimile Support for i. A malicious actor could cause user-controlled code to run with administrator privilege.
Impact
- Code Execution
- Data Manipulation
- Privilege Escalation
Indicators of Compromise
CVE
CVE-2025-36038
CVE-2025-0966
CVE-2025-36004
Affected Vendors
- IBM
Affected Products
- IBM i 7.2
- IBM WebSphere Application Server 8.5
- IBM WebSphere Application Server 9.0
- IBM InfoSphere Information Server 11.7
- IBM i 7.3
- IBM i 7.4
- IBM i 7.5
Remediation
Refer to IBM Security Advisory for patch, upgrade, or suggested workaround information.