CVE-2025-36290 Weak cryptography in Integrated Analytics System
Attackers can intercept sensitive data via man-in-the-middle attacks due to improper TLS certificate validation in the JWT service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-36290?
CVE-2025-36290 is a medium-severity vulnerability in IBM Integrated Analytics System, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.
Weakness: CWE-295
Which versions are affected by CVE-2025-36290?
It affects 1 product.
Products include Ibm Integrated Analytics System.
How do I fix CVE-2025-36290?
No fix has been published for CVE-2025-36290 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-36290 being exploited?
There is no known exploitation of CVE-2025-36290 in the wild and no public exploit code.
Other vulnerabilities in IBM Integrated Analytics System
Sources
Also known as GHSA-cc37-cfqh-jjwr.