PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-36220 IBM CVE debrief

A SQL injection vulnerability exists in IBM Cloud Pak for Data System - Cyclops versions 11.3.0.2 through Interim Fix 002. The vulnerability allows a remote, authenticated attacker to send specially crafted SQL statements that could enable viewing, adding, modifying, or deleting information in the back-end database. The CVSS 3.1 vector indicates network attack vector with low attack complexity, requiring low privileges but no user interaction. The vulnerability is classified as CWE-89 (SQL Injection). IBM has published a security bulletin with remediation guidance.

Vendor
IBM
Product
Cloud Pak for Data System - Cyclops
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-06-02
Advisory published
2026-05-26
Advisory updated
2026-06-02

Who should care

Organizations running IBM Cloud Pak for Data System - Cyclops 11.3.0.2, database administrators, security operations teams monitoring for SQL injection attempts, and compliance teams tracking vulnerability remediation for enterprise data platforms.

Technical summary

The Cyclops component in IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 002 fails to properly sanitize user-supplied input before constructing SQL queries. An attacker with low-privilege network access can inject malicious SQL syntax to manipulate back-end database operations. The vulnerability is rated CVSS 3.1 4.3 (Medium) with impact limited to integrity (no confidentiality or availability impact per current scoring). The attack requires authentication but no user interaction.

Defensive priority

medium

Recommended defensive actions

  • Apply IBM interim fix for Cyclops 11.3.0.2 or upgrade to a fixed version per IBM security bulletin guidance
  • Review database access logs for anomalous SQL query patterns from authenticated users
  • Implement principle of least privilege for database accounts used by Cyclops components
  • Consider web application firewall (WAF) rules to detect and block common SQL injection patterns
  • Monitor IBM PSIRT for updated remediation guidance as NVD analysis is pending

Evidence notes

CVE published 2026-05-26T17:16:29.143Z; modified 2026-05-26T19:06:14.330Z. IBM PSIRT reference confirms vendor acknowledgment. NVD status: Awaiting Analysis.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-36220 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-36220

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-36220 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-36220

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.