CVE-2025-36143

MEDIUM

IBM watsonx.data 2.2 - Authenticated OS Command Injection

Title source: llm
STIX 2.1

Description

IBM Lakehouse (watsonx.data 2.2) could allow an authenticated privileged user to execute arbitrary commands on the system due to improper validation of user supplied input.

References (1)

Core 1
Core References
Vendor Advisory vendor-advisory patch
https://www.ibm.com/support/pages/node/7245379

Scores

CVSS v3 4.7
EPSS 0.0003
EPSS Percentile 8.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-78
Status published
Products (1)
ibm/watsonx.data 2.2
Published Sep 18, 2025
Tracked Since Feb 18, 2026