CVE-2025-36038

Published Jun 25, 2025

Last updated 3 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-36038 is a critical remote code execution (RCE) vulnerability found in IBM WebSphere Application Server versions 8.5 and 9.0. It stems from a deserialization issue where the application doesn't properly validate the type of objects being deserialized. This allows unauthenticated attackers to execute arbitrary code on systems running the affected versions. The vulnerability can be exploited by using a specially crafted sequence of serialized objects. Successful exploitation could lead to complete system compromise, potentially allowing attackers to install malware, steal sensitive data, disrupt business operations, and use the compromised system to attack other systems on the network.

Description: IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects.
Source: psirt@us.ibm.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Primary
Base score: 9
Impact score: 6
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

psirt@us.ibm.com: CWE-502

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 1

References