PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-36221 IBM CVE debrief

IBM Cloud Pak for Data System - Cyclops versions 11.3.0.2 through Interim Fix 002 ship with default passwords from the manufacturing process that are used during installation. These credentials are not changed post-deployment, allowing network-based attackers to bypass authentication without prior access. The vulnerability is classified as CWE-1392 (Use of Default Credentials). IBM has published a security bulletin with remediation guidance.

Vendor
IBM
Product
Cloud Pak for Data System - Cyclops
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-06-02
Advisory published
2026-05-26
Advisory updated
2026-06-02

Who should care

IBM Cloud Pak for Data System administrators, security operations teams managing data platform infrastructure, and organizations with compliance requirements around credential management and default password elimination.

Technical summary

The vulnerability exists in IBM Cloud Pak for Data System - Cyclops versions 11.3.0.2 through Interim Fix 002, where default passwords from the manufacturing process remain in place for installation-time use. These credentials are not automatically changed or required to be changed during deployment, leaving systems exposed to authentication bypass. The CVSS 3.1 score of 5.3 (MEDIUM) reflects network accessibility with low complexity and no required privileges, though impact is limited to integrity (no confidentiality or availability impact per the vector). The weakness maps to CWE-1392: Use of Default Credentials. Remediation requires applying IBM's Interim Fix and manually changing all default passwords.

Defensive priority

medium

Recommended defensive actions

  • Identify all IBM Cloud Pak for Data System - Cyclops deployments running versions 11.3.0.2 through Interim Fix 002
  • Review IBM security bulletin for official remediation steps and patch availability
  • Change all default credentials installed during manufacturing process immediately
  • Audit authentication logs for unauthorized access using default accounts
  • Implement network segmentation to limit exposure of management interfaces
  • Verify no residual default credentials exist after applying Interim Fix or subsequent patches

Evidence notes

CVE published 2026-05-26T17:16:29.270Z; modified 2026-05-26T19:06:14.330Z. IBM PSIRT reference confirms affected product versions and default password issue. CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N indicates network attack vector with low attack complexity, no privileges required, and integrity impact only.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-36221 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-36221

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-36221 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-36221

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.