CVE-2025-36410
CVE-2025-36410 is a low-severity vulnerability in Ibm Applinx with a CVSS 3.x base score of 3.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-602.
Key facts
- Severity: Low (CVSS 3.x base score 3.1)
- EPSS exploit prediction: 0% (5th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-3380
- Weakness: CWE-602
- Affected product: Ibm Applinx
- Published:
- Last modified:
Description
IBM ApplinX 11.1 could allow an authenticated user to perform unauthorized administrative actions on the server due to server-side enforcement of client-side security.
Frequently asked questions
- What is CVE-2025-36410?
- IBM ApplinX 11.1 could allow an authenticated user to perform unauthorized administrative actions on the server due to server-side enforcement of client-side security.
- How severe is CVE-2025-36410?
- CVE-2025-36410 has a CVSS 3.x base score of 3.1, rated low severity. It is exploitable over network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
- Is CVE-2025-36410 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (5th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2025-36410?
- CVE-2025-36410 affects Ibm Applinx. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2025-36410?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2025-36410 have an EU (EUVD) identifier?
- Yes. CVE-2025-36410 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-3380.
- When was CVE-2025-36410 published?
- CVE-2025-36410 was published on 2026-01-20 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:ibm:applinx:11.1.0:*:*:*:*:*:*:*
More vulnerabilities in Ibm Applinx
- CVE-2025-36418 — High (CVSS 7.3): IBM ApplinX 11.1 is vulnerable due to a privilege escalation vulnerability due to improper verification of JWT tokens.…
- CVE-2025-36408 — Medium (CVSS 6.4): IBM ApplinX 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed…
- CVE-2024-49791 — Medium (CVSS 6.4): IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed…
- CVE-2024-49797 — Medium (CVSS 5.9): IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly…
- CVE-2025-36409 — Medium (CVSS 5.4): IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed…
- CVE-2024-49796 — Medium (CVSS 5.4): IBM ApplinX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to…
All CVEs affecting Ibm Applinx →
Other CWE-602 vulnerabilities
- CVE-2026-42160 — Critical (CVSS 10.0): Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dataspace management.…
- CVE-2025-33025 — Critical (CVSS 9.9): A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All…
- CVE-2025-33024 — Critical (CVSS 9.9): A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All…
- CVE-2025-32469 — Critical (CVSS 9.9): A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All…
- CVE-2026-30783 — Critical (CVSS 9.8): A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient…
- CVE-2026-23478 — Critical (CVSS 9.8): Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth…