CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2025-36072

Object Graph Chaos: Inside CVE-2025-36072

Alon Barad
Alon Barad
Software Engineer

Jan 1, 2026·5 min read·22 visits

Executive Summary (TL;DR)

IBM webMethods Integration trusts user-supplied Java objects too much. Authenticated users can feed the server a malicious 'graph' object which, upon deserialization, executes arbitrary system commands. Patch immediately.

An authenticated Remote Code Execution (RCE) vulnerability in IBM webMethods Integration caused by unsafe deserialization of object graphs.

Official Patches

IBMIBM Security Bulletin 7252090

Technical Appendix

CVSS Score
8.8/ 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Probability
0.04%
Top 100% most exploited

Affected Systems

IBM webMethods Integration 10.11IBM webMethods Integration 10.15IBM webMethods Integration 11.1

Affected Versions Detail

Product
Affected Versions
Fixed Version
webMethods Integration
IBM
10.11 to 10.11_Core_Fix2210.11_Core_Fix23
webMethods Integration
IBM
10.15 to 10.15_Core_Fix2210.15_Core_Fix23
webMethods Integration
IBM
11.1 to 11.1_Core_Fix611.1_Core_Fix7
AttributeDetail
CWECWE-502 (Deserialization of Untrusted Data)
CVSS8.8 (High)
Attack VectorNetwork (Authenticated)
ImpactRemote Code Execution (RCE)
PlatformJava
Exploit StatusNo Public PoC (Yet)

MITRE ATT&CK Mapping

T1203Exploitation for Client Execution
Execution
T1059.007Command and Scripting Interpreter: JavaScript
Execution
T1559Inter-Process Communication
Execution
CWE-502
Deserialization of Untrusted Data

The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Vulnerability Timeline

CVE Published
2025-02-14
Security Bulletin Released by IBM
2025-02-28

References & Sources

  • [1]ZeroPath Analysis
  • [2]NVD CVE-2025-36072

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•about 7 hours ago•GHSA-JHJP-4C2Q-XMX4
8.1

GHSA-JHJP-4C2Q-XMX4: Falco k8saudit Plugin Ruleset Bypass via initContainers and ephemeralContainers

A security feature bypass vulnerability in the Falco k8saudit plugin (and its cloud-specific variants) allowed privileged workloads to run undetected. This bypass occurred because the plugin's default extraction logic and rules only evaluated standard containers, completely omitting initContainers and ephemeralContainers.

Amit Schendel
Amit Schendel
4 views•6 min read
•about 8 hours ago•CVE-2026-61630
4.2

CVE-2026-61630: Time-Based One-Time Password (TOTP) Reuse/Replay in nginx-ignition

nginx-ignition is a web-based user interface for managing the Nginx web server. In versions 2.33.0 through 2.35.0, the application is vulnerable to an improper authentication flaw (CWE-287) in its Multi-Factor Authentication (MFA) implementation. The stateless validation of Time-Based One-Time Passwords (TOTP) allows an attacker to reuse a captured, active verification code multiple times within the standard 30-second validity window, successfully bypassing secondary authentication checks if primary credentials are known.

Amit Schendel
Amit Schendel
9 views•5 min read
•about 9 hours ago•CVE-2026-61629
7.5

CVE-2026-61629: CPU Amplification Denial of Service via ParseAcceptLanguage Underscore Bypass

A vulnerability exists in the i18n middleware of nginx-ignition, enabling CPU amplification attacks. By transmitting a crafted Accept-Language header containing malformed tags separated by underscores, an unauthenticated remote attacker can bypass the length-guard threshold of the underlying Go parsing library. Normalization of underscores to hyphens occurs after the initial validation checks, forcing the parser into expensive quadratic-time loops that consume 100% of available CPU resources. This leads to a complete denial of service for the administrative API and potentially degrades the availability of the hosting system. This vulnerability has been resolved in version 2.40.1.

Alon Barad
Alon Barad
6 views•7 min read
•about 10 hours ago•CVE-2026-61628
8.1

CVE-2026-61628: Unauthenticated Admin Account Creation via Onboarding Race Condition in Nginx Ignition

Nginx Ignition prior to version 2.41.1 contains a Time-of-Check to Time-of-Use (TOCTOU) race condition in its unauthenticated onboarding API endpoint. This flaw allows remote, unauthenticated attackers to register an administrative account by sending concurrent HTTP requests during the initial system configuration phase, bypassing the check meant to restrict onboarding to a single initial administrator.

Amit Schendel
Amit Schendel
7 views•6 min read
•about 16 hours ago•CVE-2026-61687
7.1

CVE-2026-61687: OAuth State Validation Bypass and Login CSRF in Hatchet

A logic error in Hatchet's OAuth state validation mechanism allows unauthenticated remote attackers to bypass state parameter verification. By submitting an empty state parameter, attackers can exploit an equality collision with cleared session keys, facilitating Login Cross-Site Request Forgery (Login CSRF) or Session Fixation.

Amit Schendel
Amit Schendel
10 views•10 min read
•3 days ago•CVE-2026-58197
8.8

CVE-2026-58197: Host Escape and Lateral Movement via Insecure Container Network Defaults in ToolHive

A high-severity access control vulnerability in ToolHive CLI before v0.30.1 and ToolHive Studio before v0.38.0 allows local containerized MCP servers to bypass network isolation. This enables malicious workloads to establish TCP/IP connections to administrative and control plane endpoints exposed on the host loopback interface.

Amit Schendel
Amit Schendel
12 views•8 min read