CVE-2025-36418 - Vulnerability Details - OpenCVE

IBM ApplinX 11.1 is vulnerable due to a privilege escalation vulnerability due to improper verification of JWT tokens. An attacker may be able to craft or modify a JSON web token in order to impersonate another user or to elevate their privileges.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Ibm	Applinx

No data.

No data.

No data.

References

Link	Providers
https://www.ibm.com/support/pages/node/7257446

History

Tue, 20 Jan 2026 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 20 Jan 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		IBM ApplinX 11.1 is vulnerable due to a privilege escalation vulnerability due to improper verification of JWT tokens. An attacker may be able to craft or modify a JSON web token in order to impersonate another user or to elevate their privileges.
Title		Multiple vulnerabilities found in IBM ApplinX.
First Time appeared		Ibm Ibm applinx
Weaknesses		CWE-347
CPEs		cpe:2.3:a:ibm:applinx:11.1:::::::*
Vendors & Products		Ibm Ibm applinx
References		https://www.ibm.com/support/pages/node/7257446
Metrics		cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}`

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2026-01-20T15:50:40.562Z

Updated: 2026-01-20T16:09:43.989Z

Reserved: 2025-04-15T21:17:01.668Z

Link: CVE-2025-36418

Vulnrichment

Updated: 2026-01-20T16:09:37.819Z

NVD

Status : Received

Published: 2026-01-20T16:16:04.790

Modified: 2026-01-20T16:16:04.790

Link: CVE-2025-36418

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-36418", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-04-15T21:17:01.668Z", "datePublished": "2026-01-20T15:50:40.562Z", "dateUpdated": "2026-01-20T16:09:43.989Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:applinx:11.1:*:*:*:*:*:*:*"], "product": "ApplinX", "vendor": "IBM", "versions": [{"status": "affected", "version": "11.1"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>IBM ApplinX 11.1 is vulnerable due to a privilege escalation vulnerability due to improper verification of JWT tokens. An attacker may be able to craft or modify a JSON web token in order to impersonate another user or to elevate their privileges.</p>"}], "value": "IBM ApplinX 11.1 is vulnerable due to a privilege escalation vulnerability due to improper verification of JWT tokens. An attacker may be able to craft or modify a JSON web token in order to impersonate another user or to elevate their privileges."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-347", "description": "CWE-347 Improper Verification of Cryptographic Signature", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-01-20T15:51:08.237Z"}, "references": [{"tags": ["vendor-advisory", "patch"], "url": "https://www.ibm.com/support/pages/node/7257446"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>IBM strongly recommends addressing the vulnerabilities now by upgrading IBM ApplinX. Product Version Remediation/Fix IBM ApplinX 11.1 Download and apply the update from Fix Central here .</p>"}], "value": "IBM strongly recommends addressing the vulnerabilities now by upgrading IBM ApplinX. Product Version Remediation/Fix IBM ApplinX 11.1 Download and apply the update from Fix Central here ."}], "title": "Multiple vulnerabilities found in IBM ApplinX.", "x_generator": {"engine": "ibm-cvegen"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T16:09:28.415356Z", "id": "CVE-2025-36418", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T16:09:43.989Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-36418", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T16:09:28.415356Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T16:09:37.819Z"}}], "cna": {"title": "Multiple vulnerabilities found in IBM ApplinX.", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:applinx:11.1:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "ApplinX", "versions": [{"status": "affected", "version": "11.1"}]}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerabilities now by upgrading IBM ApplinX. Product Version Remediation/Fix IBM ApplinX 11.1 Download and apply the update from Fix Central here .", "supportingMedia": [{"type": "text/html", "value": "<p>IBM strongly recommends addressing the vulnerabilities now by upgrading IBM ApplinX. Product Version Remediation/Fix IBM ApplinX 11.1 Download and apply the update from Fix Central here .</p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7257446", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "ibm-cvegen"}, "descriptions": [{"lang": "en", "value": "IBM ApplinX 11.1 is vulnerable due to a privilege escalation vulnerability due to improper verification of JWT tokens. An attacker may be able to craft or modify a JSON web token in order to impersonate another user or to elevate their privileges.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM ApplinX 11.1 is vulnerable due to a privilege escalation vulnerability due to improper verification of JWT tokens. An attacker may be able to craft or modify a JSON web token in order to impersonate another user or to elevate their privileges.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347 Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-01-20T15:51:08.237Z"}}}, "cveMetadata": {"cveId": "CVE-2025-36418", "state": "PUBLISHED", "dateUpdated": "2026-01-20T16:09:43.989Z", "dateReserved": "2025-04-15T21:17:01.668Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-01-20T15:50:40.562Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}