CVE-2025-36064
Ibm Sterling Connect\ express
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2025-36064 is a medium-severity Improper Restriction of Excessive Authentication Attempts (CWE-307) vulnerability in Ibm Sterling Connect\. Its CVSS base score is 5.9 (Medium).
Operationally, ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-7 (Unsuccessful Logon Attempts) and AC-2 (Account Management) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-30769
Vulnerability Data
IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces limits on consecutive unsuccessful logon attempts and account lockout duration, eliminating the inadequate lockout setting that enables brute-force attacks in this CVE.
Requires definition and enforcement of account lockout parameters as part of account management, directly addressing the missing or weak lockout configuration described in the CVE.
Enforces access-control decisions that include lockout state checks before granting authentication, preventing continued brute-force attempts once the account is locked.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Authentication enforcement directly includes lockout, throttling, and MFA policies that prevent brute-force attempts.
Behavioral monitoring of authentication activity can detect excessive failed attempts after they occur.
Generating auth logs enables later detection or forensics but does not itself restrict attempts.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
CAPTCHA, account lock-out after repeated failures, and alerts on excessive attempts directly stop automated brute-force guessing of credentials.