Deserialization of Untrusted Data in IBM WebSphere Application Server - CVE-2025-36038

Vulnerability identifier: #VU111988

CSH Severity: Critical

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-36038

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can pass a specially crafted sequence of serialized objects to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

IBM WebSphere Application Server
IBM Tivoli System Automation Application Manager
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Tivoli Monitoring
IBM Maximo Asset Management
WebSphere Remote Server
IBM Rational ClearQuest
IBM Rational ClearCase
InfoSphere Master Data Management
Enterprise Application Runtimes
Tivoli Network Manager IP Edition
Cloud Pak for Applications
WebSphere Hybrid Edition
IBM Tivoli Netcool Configuration Manager
Tivoli Composite Application Manager for Application Diagnostics
Control Desk
Business Monitor
DevOps Code ClearCase

Install updates from vendor's website.

IBM WebSphere Application Server - addressed in versions 8.5.5.28, 9.0.5.25
IBM Tivoli Monitoring - update to 6.3.0.7 Plus Service Pack 5

• https://www.ibm.com/support/pages/node/7237967

• Deserialization of Untrusted Data in IBM WebSphere Application Server
• IBM Tivoli System Automation Application Manager update for IBM WebSphere Application Server
• Deserialization of untrusted data in IBM Tivoli Composite Application Manager for Application Diagnostics
• Deserialization of untrusted data in IBM Security Guardium Key Lifecycle Manager(SKLM/GKLM)
• Deserialization of untrusted data in IBM Business Monitor
• Deserialization of untrusted data in IBM Tivoli Network Manager IP Edition
• Deserialization of untrusted data in IBM Cloud Pak for Applications
• Deserialization of untrusted data in IBM Enterprise Application Runtimes
• Deserialization of untrusted data in IBM WebSphere Hybrid Edition
• Deserialization of untrusted data in IBM WebSphere Remote Server
• Deserialization of untrusted data in IBM Tivoli Netcool Configuration Manager
• IBM Maximo Asset Management update for IBM WebSphere Application Server
• Deserialization of untrusted data in IBM Tivoli Monitoring
• Deserialization of untrusted data in IBM Watson Assistant for IBM Control Desk
• Deserialization of untrusted data in IBM Rational ClearQuest
• Multiple vulnerabilities in IBM DevOps Code ClearCase
• Deserialization of untrusted data in IBM InfoSphere Master Data Management