CVE-2025-36059: medium-severity vulnerability in IBM Business Automation Workflow containers
Multiple security vulnerabilities are addressed in IBM Business Automation Workflow Containers fixes December 2025
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.7epss 0.1%
IBM Business Automation Workflow containers 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 006. IBM Cloud Pak for Business Automation could allow a local user with access to the container to execute OS system calls.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected products
IBM · Business Automation Workflow containersRelated CVEs — IBM Business Automation Workflow containers
In the same product, most dangerous first.
CVE-2025-13096HIGHXML eXternal Entity injection (XXE) vulnerability affect IBM Business Automation Workflow -EPSS 0.5%CVE-2025-36054MEDIUMCross-site scripting vulnerability affect IBM Business Automation Workflow Process Federation Server -EPSS 0.2%CVE-2025-36058MEDIUMMultiple security vulnerabilities are addressed in IBM Business Automation Workflow Containers fixes December 2025EPSS 0.1%