Input validation error in Logback - CVE-2025-11226

Vulnerability identifier: #VU116684

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-11226

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input when parsing configuration file. A remote attacker can trick the victim into using a specially crafted configuration file and execute arbitrary code on the system.

Successful exploitation of the vulnerability requires presence of Janino library and Spring Framework on the user's class path.

Logback
IBM Observability with Instana
IBM Process Mining
PowerVC
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
Confluence Data Center
IBM Rational ClearCase
Rational Functional Tester (RFT)
watsonx.data
Storage Protect Server
Maximo Application Suite - Visual Inspection Component
IBM Business Automation Manager Open Editions
Maximo Application Suite Ai Service
Rational Performance Tester
CICS Transaction Gateway Desktop Edition
CICS Transaction Gateway for Multiplatforms
DevOps Test UI
DevOps Code ClearCase
DevOps Test Performance
Business Automation Insights
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
watsonx Assistant Cartridge
MongoDB Enterprise Advanced with IBM
StreamSets Data Collector
openSUSE Leap
logback-examples
logback-javadoc
logback-access
logback

Install updates from vendor's website.

Logback - update to 1.5.19
IBM Observability with Instana - update to 1.0.311
IBM Process Mining - update to 2.1.0
watsonx.data - update to 2.3
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.3
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.1
Storage Protect Server - update to 8.2.1
Confluence Data Center - addressed in versions 9.2.14, 10.2.10
Maximo Application Suite - Visual Inspection Component - addressed in versions 8.9.19, 9.0.16, 9.1.6
IBM Business Automation Manager Open Editions - update to 9.3.1
Maximo Application Suite Ai Service - update to 9.1.10
IBM Rational ClearCase - update to 10.0.1.6
DevOps Test UI - update to 11.0.7
DevOps Code ClearCase - update to 11.0.0.6
DevOps Test Performance - update to 11.0.8
Business Automation Insights - addressed in versions 24.0.0.0.6, 24.0.1.0.6, 25.0.0.0.3
logback-examples - update to 1.2.13-150200.3.13.1
logback-javadoc - update to 1.2.13-150200.3.13.1
logback-access - update to 1.2.13-150200.3.13.1
logback - update to 1.2.13-150200.3.13.1
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.3.0
watsonx Assistant Cartridge - update to 5.3.0
MongoDB Enterprise Advanced with IBM - addressed in versions 7.0.21, 8.0.18
StreamSets Data Collector - update to 7.2.0

• https://logback.qos.ch/news.html#1.5.19

• Arbitrary code execution in Logback
• SUSE update for logback
• IBM PowerVC update for Logback-Core
• IBM Watson Speech Services Cartridge update for logback-core
• IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge update for ACE
• Multiple vulnerabilities in IBM Maximo AI Service
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in IBM Observability with Instana (Agent)
• IBM watsonx.data update for QOS.CH logback-core
• IBM Watson Discovery Cartridge update for logback-core
• IBM Maximo Application Suite - Visual Inspection Component update for logback-core
• Multiple vulnerabilities in IBM Business Automation Insights
• MongoDB Enterprise Advanced with IBM update for logback-core
• Multiple vulnerabilities in IBM DevOps Code ClearCase
• Multiple vulnerabilities in IBM StreamSets Data Collector
• IBM Storage Protect Server update for logback-core library
• IBM DevOps Test Performance update for QOS.CH logback-core
• IBM Rational Functional Tester / DevOps Test UI update for logback-core
• Multiple vulnerabilities in IBM CICS Transaction Gateway for Multiplatforms
• Multiple vulnerabilities in CICS Transaction Gateway Desktop Edition
• Input validation error in Confluence Data Center