CVE-2025-36005

moderate-risk

Published 2025-07-24

IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Internet Pass-Thru could allow a malicious user to obtain sensitive information from another TLS session connection by the proxy to the same hostname and port due to improper certificate validation.

Do I need to act?

-

0.03% chance of exploitation

EPSS score — low exploit probability

-

Not on CISA KEV list

No confirmed active exploitation reported to CISA

?

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

5

CVSS 5.9/10 Medium

NETWORK / HIGH complexity

Affected Products (20)

Mq Operator

Mq Operator

Mq Operator

Mq Operator

Mq Operator

Mq Operator

Mq Operator

Supplied Mq Advanced Container Images

Supplied Mq Advanced Container Images

Supplied Mq Advanced Container Images

Supplied Mq Advanced Container Images

Supplied Mq Advanced Container Images

Supplied Mq Advanced Container Images

Supplied Mq Advanced Container Images

Supplied Mq Advanced Container Images

Supplied Mq Advanced Container Images

Supplied Mq Advanced Container Images

Supplied Mq Advanced Container Images

Supplied Mq Advanced Container Images

Supplied Mq Advanced Container Images

Affected Vendors

Ibm

References (1)

Vendor Advisory https://www.ibm.com/support/pages/node/7240431

45

/ 100

moderate-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 27/34 · High