CVE-2025-36355: security verify access 10.0.9.0; +5 more affected products

Affected technology

security verify access · from 10.0.0.0 (inclusive), before 10.0.9.0 (exclusive)
ibm

security verify access · 10.0.9.0
ibm

security verify access · 10.0.9.0 · update interim_fix1
ibm

security verify access · 10.0.9.0 · update interim_fix2
ibm

security verify access docker · from 10.0.0.0 (inclusive), before 10.0.9.0 (exclusive)
ibm

security verify access docker · 10.0.9.0
ibm

security verify access docker · 10.0.9.0 · update interim_fix1
ibm

security verify access docker · 10.0.9.0 · update interim_fix2
ibm

verify identity access · from 11.0.0.0 (inclusive), before 11.0.1.0 (exclusive)
ibm

verify identity access · 11.0.1.0
ibm

verify identity access docker · from 11.0.0.0 (inclusive), before 11.0.1.0 (exclusive)
ibm

verify identity access docker · 11.0.1.0
ibm

Security Verify Access Appliance · 10.0.0.0 through 10.0.9.0 IF2, 11.0.0.0 through 11.0.1.0
IBM

Security Verify Access Docker · 10.0.0.0 through 10.0.9.0 IF2, 11.0.0.0 through 11.0.1.0
IBM

Description’s affected range: through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Local · No privileges required · No user interaction required

What an attacker can do

A locally authenticated user could execute malicious scripts from outside of its control sphere. Vendor/CNA’s CVSS 3.1 assessment (base score 8.5/10) rates confidentiality impact as high; integrity and availability impact as low.