{"id":"CVE-2025-36222","state":"PUBLISHED","title":"IBM Fusion insecure default configuration","description":"IBM Fusion 2.2.0 through 2.10.1, IBM Fusion HCI 2.2.0 through 2.10.0, and IBM Fusion HCI for watsonx 2.8.2 through 2.10.0 uses insecure default configurations that could expose AMQStreams without client authentication that could allow an attacker to perform unauthorized actions.","publishedAt":"2025-09-11T20:44:06.696Z","updatedAt":"2026-02-26T17:48:40.895Z","severity":{"score":8.7,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","source":"ibm"},"assigner":"ibm","products":["IBM Fusion","IBM Fusion HCI","IBM Fusion HCI for watsonx"],"affected":[{"vendor":"IBM","product":"Fusion","defaultStatus":"unaffected","versions":[{"version":"2.2.0","status":"affected","lessThanOrEqual":"2.10.1","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:storage_fusion:2.2.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:storage_fusion:2.10.1:*:*:*:*:*:*:*"]},{"vendor":"IBM","product":"Fusion HCI","defaultStatus":"unaffected","versions":[{"version":"2.2.0","status":"affected","lessThanOrEqual":"2.10.0","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:storage_fusion_hci:2.2.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:storage_fusion_hci:2.10.0:*:*:*:*:*:*:*"]},{"vendor":"IBM","product":"Fusion HCI for watsonx","defaultStatus":"unaffected","versions":[{"version":"2.8.2","status":"affected","lessThanOrEqual":"2.10.0","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:storage_fusion_hci_for_watsonx:2.8.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:storage_fusion_hci_for_watsonx:2.10.0:*:*:*:*:*:*:*"]}],"references":["https://www.ibm.com/support/pages/node/7244646"],"weaknesses":["CWE-1188"],"ingestedAt":"2026-10-29T20:09:03.054Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/36xxx/CVE-2025-36222.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-36222","state":"PUBLISHED","datePublished":"2025-09-11T20:44:06.696Z","dateUpdated":"2026-02-26T17:48:40.895Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2025-04-15T21:16:41.802Z"},"containers":{"cna":{"title":"IBM Fusion insecure default configuration","descriptions":[{"lang":"en","value":"IBM Fusion 2.2.0 through 2.10.1, IBM Fusion HCI 2.2.0 through 2.10.0, and IBM Fusion HCI for watsonx 2.8.2 through 2.10.0 uses insecure default configurations that could expose AMQStreams without client authentication that could allow an attacker to perform unauthorized actions."}],"affected":[{"vendor":"IBM","product":"Fusion","defaultStatus":"unaffected","versions":[{"version":"2.2.0","status":"affected","lessThanOrEqual":"2.10.1","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:storage_fusion:2.2.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:storage_fusion:2.10.1:*:*:*:*:*:*:*"]},{"vendor":"IBM","product":"Fusion HCI","defaultStatus":"unaffected","versions":[{"version":"2.2.0","status":"affected","lessThanOrEqual":"2.10.0","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:storage_fusion_hci:2.2.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:storage_fusion_hci:2.10.0:*:*:*:*:*:*:*"]},{"vendor":"IBM","product":"Fusion HCI for watsonx","defaultStatus":"unaffected","versions":[{"version":"2.8.2","status":"affected","lessThanOrEqual":"2.10.0","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:storage_fusion_hci_for_watsonx:2.8.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:storage_fusion_hci_for_watsonx:2.10.0:*:*:*:*:*:*:*"]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7244646","tags":["vendor-advisory","patch"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1188","description":"CWE-1188 Insecure Default Initialization of Resource","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"ibm","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateUpdated":"2025-09-11T20:44:06.696Z"},"credits":[{"lang":"en","type":"finder","value":"Robert Hotchkiss"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

IBM strongly recommends addressing the vulnerability now.

ProductsVersion range Remediation Instructions
IBM Fusion2.2.0 - 2.10.1Upgrade to IBM Fusion 2.11.0. See the README for instructions..
IBM Fusion HCI2.2.0 - 2.10.0Upgrade to IBM Fusion HCI 2.11.0. See the README for instructions.
IBM Fusion HCI for watsonx2.8.2 - 2.10.0Upgrade to IBM Fusion HCI for watsonx 2.11.0. See README for instructions.
\n\n
"}],"value":"IBM strongly recommends addressing the vulnerability now.\n\nProductsVersion range Remediation InstructionsIBM Fusion2.2.0 - 2.10.1Upgrade to IBM Fusion 2.11.0. See the README https://www.ibm.com/support/pages/node/7242341  for instructions..IBM Fusion HCI2.2.0 - 2.10.0Upgrade to IBM Fusion HCI 2.11.0. See the README https://www.ibm.com/support/pages/node/7242340  for instructions.IBM Fusion HCI for watsonx2.8.2 - 2.10.0Upgrade to IBM Fusion HCI for watsonx 2.11.0. See README https://www.ibm.com/support/pages/node/7242340  for instructions."}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-36222","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-09-13T03:55:39.299346Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-26T17:48:40.895Z"}}]}}}