CVE-2025-36222 in Fusion
Summary
by MITRE • 09/12/2025
IBM Fusion 2.2.0 through 2.10.1, IBM Fusion HCI 2.2.0 through 2.10.0, and IBM Fusion HCI for watsonx 2.8.2 through 2.10.0 uses insecure default configurations that could expose AMQStreams without client authentication that could allow an attacker to perform unauthorized actions.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/03/2025
This vulnerability affects IBM Fusion and IBM Fusion HCI versions ranging from 2.2.0 through 2.10.1 for Fusion and 2.2.0 through 2.10.0 for Fusion HCI, along with IBM Fusion HCI for watsonx versions 2.8.2 through 2.10.0. The security issue stems from insecure default configurations that fail to properly enforce client authentication mechanisms for AMQStreams components. This flaw creates a critical exposure where attackers can potentially access streaming data without proper authorization, undermining the integrity and confidentiality of enterprise data flows.
The technical implementation of this vulnerability resides in the default security settings that govern how AMQStreams handle client connections and authentication processes. When systems are deployed with default configurations, they often prioritize ease of deployment over security best practices, leading to the omission of mandatory authentication requirements for streaming connections. This misconfiguration allows unauthorized entities to establish connections to the streaming infrastructure and potentially perform administrative actions or access sensitive data streams without proper credentials or authorization. The vulnerability specifically impacts the messaging and data streaming capabilities that form the backbone of these enterprise fusion platforms.
The operational impact of this vulnerability extends beyond simple unauthorized access, as it creates potential pathways for data exfiltration, service disruption, and privilege escalation within the affected environments. Attackers exploiting this flaw could manipulate streaming data, interfere with business processes that depend on real-time data flows, or gain insights into operational activities through unauthorized data access. The exposure affects organizations using these platforms for critical business operations where data integrity and access control are paramount. The vulnerability's scope increases when considering that these platforms are often deployed in enterprise environments with sensitive data processing requirements.
Organizations should immediately review and update their default configurations to enforce mandatory client authentication for all AMQStreams connections. Security hardening measures must include implementing proper authentication mechanisms, disabling unnecessary default accounts, and configuring access controls according to the principle of least privilege. System administrators should conduct comprehensive audits of their deployment configurations to identify and remediate any insecure defaults. The vulnerability aligns with CWE-312 (Sensitive Data Exposure) and CWE-287 (Improper Authentication) categories, representing a clear violation of security best practices established in industry standards. Mitigation strategies should follow ATT&CK framework principles for credential access and defense evasion techniques, ensuring that unauthorized access attempts are properly detected and prevented through network monitoring and access control enforcement.