Medium severity · published Sep 18, 2025
CVE-2025-36146
IBM watsonx.data information disclosure
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
IBM Lakehouse (watsonx.data 2.2) could allow an authenticated user to obtain sensitive server component version information which could aid in further attacks against the system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
watsonx.data · IBM
2.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-36146
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-36146
Vendor Advisory
https://www.ibm.com/support/pages/node/7245384
More from watsonx.data
7.5
CVE-2025-36180
Inadequate Pod Communication Restrictions, affects watsonx.data
7.2
CVE-2025-36143
IBM watsonx.data command execution
6.5
CVE-2025-36140
IBM watsonx.data Denial of Service
5.5
CVE-2025-36335
Vulnerabilities found
5.5
CVE-2025-36144
IBM watsonx.data information disclosure