Medium severity · published May 26, 2026
CVE-2025-36145
Multiple Vulnerabilities in watsonx.data
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
IBM watsonx.data 2.2 through 2.3.1 IBM Lakehouse does not properly restrict inbound and outbound connections which could allow an attacker to transfer or modify files without restrictions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
watsonx.data · IBM
2.2.0 through 2.3.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-36145
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-36145
Vendor Advisory
https://www.ibm.com/support/pages/node/7272498
More from watsonx.data
7.5
CVE-2025-36180
Inadequate Pod Communication Restrictions, affects watsonx.data
2.7
CVE-2025-36183
Privileged User File Upload Vulnerability Leading to Limited Server-Side Execution affects watsonx.data