CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2025-36072

Object Graph Chaos: Inside CVE-2025-36072

Alon Barad
Alon Barad
Software Engineer

Jan 1, 2026·5 min read·19 visits

Executive Summary (TL;DR)

IBM webMethods Integration trusts user-supplied Java objects too much. Authenticated users can feed the server a malicious 'graph' object which, upon deserialization, executes arbitrary system commands. Patch immediately.

An authenticated Remote Code Execution (RCE) vulnerability in IBM webMethods Integration caused by unsafe deserialization of object graphs.

Official Patches

IBMIBM Security Bulletin 7252090

Technical Appendix

CVSS Score
8.8/ 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Probability
0.04%
Top 100% most exploited

Affected Systems

IBM webMethods Integration 10.11IBM webMethods Integration 10.15IBM webMethods Integration 11.1

Affected Versions Detail

Product
Affected Versions
Fixed Version
webMethods Integration
IBM
10.11 to 10.11_Core_Fix2210.11_Core_Fix23
webMethods Integration
IBM
10.15 to 10.15_Core_Fix2210.15_Core_Fix23
webMethods Integration
IBM
11.1 to 11.1_Core_Fix611.1_Core_Fix7
AttributeDetail
CWECWE-502 (Deserialization of Untrusted Data)
CVSS8.8 (High)
Attack VectorNetwork (Authenticated)
ImpactRemote Code Execution (RCE)
PlatformJava
Exploit StatusNo Public PoC (Yet)

MITRE ATT&CK Mapping

T1203Exploitation for Client Execution
Execution
T1059.007Command and Scripting Interpreter: JavaScript
Execution
T1559Inter-Process Communication
Execution
CWE-502
Deserialization of Untrusted Data

The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Vulnerability Timeline

CVE Published
2025-02-14
Security Bulletin Released by IBM
2025-02-28

References & Sources

  • [1]ZeroPath Analysis
  • [2]NVD CVE-2025-36072

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•43 minutes ago•CVE-2026-72805
6.9

CVE-2026-72805: Missing Authorization in SiYuan Note Block APIs Leads to Information Disclosure

SiYuan Note versions before v3.7.4 fail to enforce publish-access checks on several block API endpoints. This vulnerability allows anonymous readers or authorized accounts with low-privileged roles to retrieve sensitive document titles, ancestor block content snippets, reference text, and path metadata for publish-forbidden or password-protected documents by supplying target block IDs.

Alon Barad
Alon Barad
2 views•6 min read
•about 2 hours ago•CVE-2026-72804
9.2

CVE-2026-72804: Authentication Bypass and Sensitive Information Exposure in SiYuan Graph Endpoints

SiYuan before version 3.7.4 contains an authentication bypass vulnerability within its graph visualization API endpoints, allowing unauthenticated remote attackers to extract sensitive node metadata and content from password-protected documents.

Alon Barad
Alon Barad
2 views•7 min read
•about 3 hours ago•CVE-2026-72802
6.9

CVE-2026-72802: Sensitive Information Disclosure via Administrative Asset Resolvers in SiYuan Note

SiYuan Note versions prior to v3.7.4 contain an information disclosure vulnerability in the `/api/asset/resolveAssetPath` endpoint. This endpoint returns absolute backend filesystem paths unmodified to CheckAuth-only requests. Low-privileged users or unauthenticated readers under publish mode can exploit this to leak the local directory layout, operating system username, and overall host deployment structure.

Amit Schendel
Amit Schendel
2 views•6 min read
•about 4 hours ago•CVE-2026-72801
8.7

CVE-2026-72801: Information Disclosure of Cryptographic Key Material in SiYuan

An access control vulnerability in the SiYuan personal knowledge management platform before version v3.7.4 exposes notebook encryption parameters to unauthenticated remote attackers. When the platform is configured in Publish Mode, specific API endpoints fail to enforce authorization checks. This access failure leaks key-derivation materials, password verifiers, and wrapped database keys to anonymous network clients.

Amit Schendel
Amit Schendel
3 views•6 min read
•about 6 hours ago•CVE-2026-72800
5.8

CVE-2026-72800: Missing Authorization in SiYuan Personal Knowledge Management System

A security vulnerability in the SiYuan local-first personal knowledge management system allows unauthenticated remote attackers to bypass logical boundary controls in publish (read-only) mode. By interacting with endpoints that lack proper publish-access validation, an attacker can disclose the application's internal database schemas and harvest block IDs across both public and private notebooks. This metadata leakage compromises the confidentiality of restricted documents and provides foundational information for targeted extraction.

Alon Barad
Alon Barad
3 views•5 min read
•about 7 hours ago•CVE-2026-72803
6.9

CVE-2026-72803: Information Disclosure via Missing Authorization in SiYuan API

An information disclosure vulnerability exists in the SiYuan personal knowledge management system versions prior to v3.7.4. The application fails to enforce publish-access filters on block attribute retrieval endpoints. Consequently, unauthenticated remote attackers can bypass document-level protection rules (such as password protection or disabled-publish flags) to retrieve sensitive block-level attributes, including aliases, memos, block names, and custom metadata fields, by querying the API using guessed or known block IDs.

Alon Barad
Alon Barad
5 views•7 min read