CVE-2025-36436: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for January 2026.

Published Jan 30, 2026
·
Updated

IBM Business Automation Workflow is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Other sources

IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 007  is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

MITRE

Affected Software

18 affected components
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation>=24.0.0<=24.0.0 Interim Fix 007, >=24.0.1<=24.0.1 Interim Fix 005, >=25.0.0<=25.0.0 Interim Fix 002
IBM Cloud Pak for Business Automation=24.0.0
IBM Cloud Pak for Business Automation=24.0.0-interim_fix_001
IBM Cloud Pak for Business Automation=24.0.0-interim_fix_002
IBM Cloud Pak for Business Automation=24.0.0-interim_fix_003
IBM Cloud Pak for Business Automation=24.0.0-interim_fix_004
IBM Cloud Pak for Business Automation=24.0.0-interim_fix_005
IBM Cloud Pak for Business Automation=24.0.0-interim_fix_006
IBM Cloud Pak for Business Automation=24.0.0-interim_fix_007
IBM Cloud Pak for Business Automation=24.0.1
IBM Cloud Pak for Business Automation=24.0.1-interim_fix_001
IBM Cloud Pak for Business Automation=24.0.1-interim_fix_002
IBM Cloud Pak for Business Automation=24.0.1-interim_fix_004
IBM Cloud Pak for Business Automation=24.0.1-interim_fix_005
IBM Cloud Pak for Business Automation=25.0.0
IBM Cloud Pak for Business Automation=25.0.0-interim_fix_001
IBM Cloud Pak for Business Automation=25.0.0-interim_fix_002

Remediation

Information

Affected Product(s)Version(s)Remediation / FixIBM Cloud Pak for Business AutomationV25.0.0 - V25.0.0-IF002Apply security fix 25.0.0-IF003 https://www.ibm.com/support/pages/readme-ibm-cloud-pak-business-automation-2500-if003 IBM Cloud Pak for Business AutomationV24.0.1 - V24.0.1-IF005Apply security fix 24.0.1-IF006 https://www.ibm.com/support/pages/readme-ibm-cloud-pak-business-automation-2401-if006 IBM Cloud Pak for Business AutomationV24.0.0 - V24.0.0-IF007Apply security fix 24.0.0-IF008 https://www.ibm.com/support/pages/readme-ibm-cloud-pak-business-automation-2400-if008

Event History

Jan 30, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Feb 2, 2026
CVE Published
via MITRE·09:51 PM
Data Sourced
via MITRE·09:51 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·11:15 PM
DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-36436?

CVE-2025-36436 has been classified as having a medium severity due to its potential impact on application security.

2

How do I fix CVE-2025-36436?

To mitigate CVE-2025-36436, users should apply the latest iFixes for IBM Cloud Pak for Business Automation.

3

Who is affected by CVE-2025-36436?

CVE-2025-36436 affects users of IBM Business Automation Workflow and IBM Cloud Pak for Business Automation versions specified in the vulnerability report.

4

What type of vulnerability is CVE-2025-36436?

CVE-2025-36436 is a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject arbitrary JavaScript code into the Web UI.

5

When was CVE-2025-36436 disclosed?

CVE-2025-36436 was disclosed as part of the January 2026 iFixes for IBM Cloud Pak for Business Automation.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203