IBMCVE-2025-36290
IBM Integrated Analytics System: information disclosure
Medium5.9CVE-2025-36290 · Published Aug 28, 2026 · updated Sep 2, 2026
IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Integrated Analytics System Product | >= 1.0.0.0, <= 1.0.31.0 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-295
More IBM advisories
All IBM| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 28 | IBM Concert: SQL injection | Critical9.1 | No fix yet |
| Aug 28 | IBM Cloud Pak for Data System: denial of service | Medium6.2 | No fix yet |
| Aug 28 | IBM Langflow OSS: path traversal | High7.5 | No fix yet |
| Aug 28 | IBM Langflow OSS: information disclosure | High8.2 | No fix yet |
| Aug 28 | IBM Langflow OSS: remote code execution | Critical9.8 | No fix yet |
| Aug 28 | IBM Langflow OSS: improper authorization | Medium6.4 | No fix yet |