Cyber Resilience

CVE-2025-36411

CSRF in Ibm Applinx 11.1.0

CSRF
Published
20 January 2026
Modified
26 January 2026
Patch / advisory
View advisory
CVSS Score v3.1 3.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
EPSS Score 0.0010 1th percentile
Risk Priority 15 floored blend · peak EPSS

Summary

CVE-2025-36411 is a low-severity CSRF (CWE-352) vulnerability in Ibm Applinx. Its CVSS base score is 3.5 (Low).

Operationally, ranked at the 1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

CWE(s)
CWE-352

Related Threats

CVEs Like This One

CVE-2024-49794Same product: Ibm Applinx
CVE-2024-49795Same product: Ibm Applinx
CVE-2023-47718Same vendor: Ibm
CVE-2023-23473Same vendor: Ibm
CVE-2023-38001Same vendor: Ibm
CVE-2023-38739Same vendor: Ibm
CVE-2023-28949Same vendor: Ibm
CVE-2024-49340Same vendor: Ibm
CVE-2024-31902Same vendor: Ibm
CVE-2024-43192Same vendor: Ibm

Affected Assets

ibm
applinx
11.1.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • SI-10 Information Input Validation
  • SC-23 Session Authenticity
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V3.3.2
  • V3.5.1
  • V10.2.1

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Enforces that every state-changing request must satisfy authorization policy, directly blocking forged requests that lack a valid user-initiated token or origin.

SI-10 Information Input Validation good match
prevent

Requires validation of all inputs (including anti-CSRF tokens, Origin/Referer headers, and request context) before ApplinX accepts an action.

SC-23 Session Authenticity partial match
prevent

Protects session authenticity so that ApplinX can reject cross-site requests that do not prove they originated from the legitimate authenticated session.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require anti-CSRF controls such as tokens or SameSite attributes.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.23 Web filtering partial match
mitigates

By denying access to phishing or malicious sites, the control lowers the likelihood that a user will be tricked into submitting a forged request that performs an unintended action on another site.

A.5.7 Threat intelligence none match
none

Contextual intelligence about emerging CSRF toolkits can be translated into updated anti-CSRF token or same-site policy configurations across applications.

References