CVE-2025-36360 IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an Insufficient Session Expiration vulnerability

Medium 5.0 Published 15 Dec 2025 Updated 15 Dec 2025

A race condition in session IP binding allows brief session reuse from new IPs, potentially enabling unauthorized access in IBM DevOps Deploy.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-36360?

CVE-2025-36360 is a medium-severity vulnerability in Ibm Urbancode Deploy, published on 15 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

IBM UCD - IBM UrbanCode Deploy 7.1 through 7.1.2.27, 7.2 through 7.2.3.20, and 7.3 through 7.3.2.15 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.10, and 8.1 through 8.1.2.3 is susceptible to a race condition in http-session client-IP binding enforcement which may allow a session to be briefly reused from a new IP address before it is invalidated, potentially enabling unauthorized access under certain network conditions.

Weakness: CWE-613

Which versions are affected by CVE-2025-36360?

It affects 2 products.

Products include Ibm Devops Deploy, Ibm Urbancode Deploy.

How do I fix CVE-2025-36360?

No fix has been published for CVE-2025-36360 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-36360 being exploited?

There is no known exploitation of CVE-2025-36360 in the wild and no public exploit code.

All Ibm Urbancode Deploy vulnerabilities

Sources

Also known as GHSA-x855-7vwp-xj8v.