CVE-2025-36336 IBM CVE debrief

Who should care

Defenders and security teams responsible for IBM watsonx.data intelligence deployments, particularly those using versions 5.2.0 through 5.3.0, should assess exposure and implement mitigations.

Why it matters

CVE-2025-36336 allows potential attackers to obtain sensitive information via clear text data transmission in IBM watsonx.data intelligence versions 5.2.0 through 5.3.0. Defenders should verify exposure, prioritize mitigation, and implement secure communication protocols to prevent potential sensitive information disclosure and man-in-the-middle attacks.

• Potential sensitive information disclosure due to clear text data transmission.
• Possible man-in-the-middle attacks targeting IBM watsonx.data intelligence deployments.
• Need for verification of affected versions and exposure in inventory.
• Priority for implementing encryption or secure communication protocols.

Technical summary

IBM watsonx.data intelligence versions 5.2.0, 5.2.1, 5.2.2, and 5.3.0 transmit data in clear text, making it possible for attackers to intercept sensitive information using man-in-the-middle techniques. This vulnerability allows potential attackers to obtain sensitive information, and defenders should verify exposure, prioritize mitigation, and implement secure communication protocols to prevent potential sensitive information disclosure. The affected versions and exposure in inventory should be verified, and encryption or secure communication protocols should be

Defensive priority

Defenders should prioritize verifying and mitigating exposure to unencrypted data transmission in IBM watsonx.data intelligence versions 5.2.0 through 5.3.0.

Recommended defensive actions

• Verify and inventory IBM watsonx.data intelligence deployments for versions 5.2.0 through 5.3.0.
• Assess exposure to unencrypted data transmission in affected versions.
• Implement encryption or secure communication protocols for data transmission in IBM watsonx.data intelligence.
• Monitor for potential man-in-the-middle attacks targeting IBM watsonx.data intelligence deployments.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and affected versions. However, additional information on potential exploitation or impact is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.