CVE-2025-36094
Published: 03 February 2026
Summary
CVE-2025-36094 is a medium-severity Improper Validation of Specified Quantity in Input (CWE-1284) vulnerability in Ibm Cloud Pak For Business Automation. Its CVSS base score is 5.4 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 21.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper input length validation enables authenticated network exploitation to trigger application DoS (T1499.004) or stored data corruption/manipulation (T1565.001).
NVD Description
IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 007 could allow an authenticated user to cause a denial of service or corrupt existing data…
more
due to the improper validation of input length.
Deeper analysisAI
CVE-2025-36094 is a vulnerability in IBM Cloud Pak for Business Automation affecting versions 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 007. It stems from improper validation of input length (CWE-1284), which can enable an authenticated user to cause a denial of service or corrupt existing data. The vulnerability has a CVSS v3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), indicating medium severity with network accessibility, low attack complexity, and low impacts to integrity and availability but no confidentiality impact.
An authenticated user with low privileges (PR:L) can exploit this over the network without user interaction by supplying inputs that exceed expected lengths. Successful exploitation allows the attacker to trigger a denial of service, disrupting service availability, or corrupt existing data, potentially leading to integrity violations such as altered records or workflows in the Business Automation environment.
For mitigation details, refer to the IBM security bulletin at https://www.ibm.com/support/pages/node/7259318, which provides guidance on applying patches or workarounds for the affected versions.
Details
- CWE(s)