Read the docs
TI-2025-24663 Aliases CVE-2025-36059GHSA-mmj2-2gvh-9pjf

Multiple security vulnerabilities are addressed in IBM Business Automation Workflow Containers fixes December 2025

Priority LOW 24CWE-250Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-250.

Summary

IBM Business Automation Workflow containers 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 006. IBM Cloud Pak for Business Automation could allow a local user with access to the container to execute OS system calls.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00106 1st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMBusiness Automation Workflow containers25.0.0 – 25.0.0 Interim Fix 002; 24.0.1 – 24.0.1 Interim Fix 005; 24.0.0 – 24.0.0 Interim Fix 006—No fix listedCNA
  • Business Automation Workflow containers VendorIBM Affected 25.0.0 – 25.0.0 Interim Fix 002; 24.0.1 – 24.0.1 Interim Fix 005; 24.0.0 – 24.0.0 Interim Fix 006 Fixed in — No fix listed CNA

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:-:*:*:containers:*:*:*24.0.0VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if001:*:*:containers:*:*:*24.0.0 if001VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if002:*:*:containers:*:*:*24.0.0 if002VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if003:*:*:containers:*:*:*24.0.0 if003VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if004:*:*:containers:*:*:*24.0.0 if004VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if005:*:*:containers:*:*:*24.0.0 if005VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if006:*:*:containers:*:*:*24.0.0 if006VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.1:-:*:*:containers:*:*:*24.0.1VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if001:*:*:containers:*:*:*24.0.1 if001VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if002:*:*:containers:*:*:*24.0.1 if002VulnerableIBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:-:*:*:containers:*:*:* Versions 24.0.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if001:*:*:containers:*:*:* Versions 24.0.0 if001 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if002:*:*:containers:*:*:* Versions 24.0.0 if002 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if003:*:*:containers:*:*:* Versions 24.0.0 if003 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if004:*:*:containers:*:*:* Versions 24.0.0 if004 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if005:*:*:containers:*:*:* Versions 24.0.0 if005 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.0:if006:*:*:containers:*:*:* Versions 24.0.0 if006 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.1:-:*:*:containers:*:*:* Versions 24.0.1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if001:*:*:containers:*:*:* Versions 24.0.1 if001 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if002:*:*:containers:*:*:* Versions 24.0.1 if002 Vulnerable ·IBM
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if004:*:*:containers:*:*:*24.0.1 if004VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if005:*:*:containers:*:*:*24.0.1 if005VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:25.0.0:-:*:*:containers:*:*:*25.0.0VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if001:*:*:containers:*:*:*25.0.0 if001VulnerableIBM
cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if002:*:*:containers:*:*:*25.0.0 if002VulnerableIBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if004:*:*:containers:*:*:* Versions 24.0.1 if004 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:24.0.1:if005:*:*:containers:*:*:* Versions 24.0.1 if005 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:25.0.0:-:*:*:containers:*:*:* Versions 25.0.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if001:*:*:containers:*:*:* Versions 25.0.0 if001 Vulnerable ·IBM
  • cpe:2.3:a:ibm:business_automation_workflow:25.0.0:if002:*:*:containers:*:*:* Versions 25.0.0 if002 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    IBM Business Automation Workflow containers — ibm.com/support/pages/node/7256777

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2025-24662 Multiple security vulnerabilities are addressed in IBM Business Automation Workflow Containers fixes December 2025Priority LOW 24
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-36059
  2. 2026-10-03 Alias added: GHSA-mmj2-2gvh-9pjf

References

Patch 1

  • TI-2022-21536 IBM Business Automation Workflow information disclosure CVSS 3.1HIGH 7.5
  • TI-2018-01487 SQL injection in IBM Business Process Manager CVSS 3.0HIGH 8.8
  • TI-2019-03267 XML external entity injection in IBM Business Automation Workflow CVSS 3.1HIGH 8.2
  • TI-2018-01730 Cross-site request forgery in IBM Business Automation Workflow CVSS 3.0HIGH 8.8
  • TI-2022-20639 IBM Business Automation Workflow cross-site request forgery CVSS 3.1HIGH 8.8
  • TI-2025-11979 XML eXternal Entity injection (XXE) vulnerability affect IBM Business Automation Workflow - CVSS 3.1HIGH 7.1
See all 53 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences