Security readout for executives and security teams
Plain-English summary
IBM watsonx.data intelligence saves user passwords on the system in plain text instead of scrambling them. Anyone who already has a login on that server can read those credentials and reuse them to impersonate other users or pivot into connected systems. The flaw does not let an outsider break in directly, but it weakens internal controls and audit trust if the platform is shared by multiple staff or service accounts.
Executive priority
Schedule patching during the next standard maintenance window. Treat as a moderate insider-risk and lateral-movement issue rather than an internet-facing emergency. Prioritize sooner where the platform is shared by multiple administrators, contractors, or where it brokers access to regulated data sources.
Technical view
CVE-2025-36335 is a CWE-256 plaintext credential storage flaw in IBM watsonx.data intelligence versions 5.2.0, 5.2.1, 5.3.0, and 5.3.1. CVSS 3.1 vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (6.2) reflects local access with no privileges required and high confidentiality impact. A local user reading the storage location can recover credentials, enabling lateral movement or replay against integrated data sources.
Likely exposure
Exposure is limited to environments running IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.3.0, or 5.3.1 where multiple OS-level users, shell access, or backup readers exist on the host. Single-tenant or tightly access-controlled appliances see lower practical risk; shared analytics platforms with several admins or service accounts face higher exposure.
Exploitation context
No public reports of active exploitation and the CVE is not listed in CISA KEV. The CVSS vector requires local access with no privileges, so exploitation presumes an attacker or insider already on the host. Impact is confidentiality of stored credentials, which can extend the blast radius of any prior foothold or insider misuse.
Researcher notes
CWE-256 with AV:L and PR:N indicates the credential file is reachable to any local user without elevation. Validate by confirming file permissions and storage format on a representative install before and after applying the IBM fix. Pair upgrade with credential rotation across federated data connections; assume any cached secrets are compromised in shared environments.
Mitigation direction
- Review IBM Security Bulletin at the vendor advisory and apply the fix or version IBM specifies.
- Restrict OS-level access to watsonx.data intelligence hosts to a minimal admin group.
- Rotate any credentials that were stored by affected versions after remediation.
- Tighten file system, backup, and snapshot permissions on the credential store paths.
- Monitor host access logs for unexpected reads of watsonx.data configuration directories.
Validation and detection
- Inventory watsonx.data intelligence instances and confirm whether versions 5.2.0, 5.2.1, 5.3.0, or 5.3.1 are deployed.
- Cross-check installed build against the fixed version listed in IBM support note 7270923.
- Audit local accounts and groups with read access to the application directory and backups.
- Confirm credential rotation completed for all integrations after upgrade.
- Verify monitoring or DLP rules flag access to credential storage locations.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-256: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-36335 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N2.53.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.2MediumVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.ibm.com/support/pages/node/7270923CVE reference · vendor-advisory, patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Plaintext Storage of a Password
Plaintext Storage of a Password represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.