CVE-2025-36058: Multiple security vulnerabilities are addressed in IBM Business Automation Workflow Containers fixes December 2025
IBM Business Automation Workflow containers 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 006. IBM Cloud Pak for Business Automation and IBM Business Automation Workflow containers may disclose sensitve configuration information in a config map.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-36058?
CVE-2025-36058 has a moderate severity rating due to multiple vulnerabilities present in the affected versions.
How do I fix CVE-2025-36058?
To fix CVE-2025-36058, update to the latest versions of IBM Business Automation Workflow or IBM Cloud Pak for Business Automation as specified in the fixes.
Which versions are affected by CVE-2025-36058?
CVE-2025-36058 affects IBM Business Automation Workflow versions 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 006.
What products are impacted by CVE-2025-36058?
The products impacted by CVE-2025-36058 are IBM Business Automation Workflow and IBM Cloud Pak for Business Automation.
Are there alternative mitigations for CVE-2025-36058 if I cannot update?
If you cannot update, consider implementing network segmentation and monitoring for suspicious activities as alternative mitigations for CVE-2025-36058.