{"id":"CVE-2025-36222","aliases":["EUVD-2025-28994","GHSA-g96v-hcqx-rf45"],"status":"published","title":"IBM Fusion insecure default configuration","description":"IBM Fusion 2.2.0 through 2.10.1, IBM Fusion HCI 2.2.0 through 2.10.0, and IBM Fusion HCI for watsonx 2.8.2 through 2.10.0 uses insecure default configurations that could expose AMQStreams without client authentication that could allow an attacker to perform unauthorized actions.","severity":{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00387,"percentile":0.33206,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1188"],"published":"2025-09-11T20:44:06Z","modified":"2026-10-18T21:10:00Z","products":[{"vendor":"ibm","product":"fusion"},{"vendor":"ibm","product":"fusion hci"},{"vendor":"ibm","product":"fusion hci for watsonx"},{"vendor":"ibm","product":"storage_fusion"},{"vendor":"ibm","product":"storage_fusion_hci"},{"vendor":"ibm","product":"storage_fusion_hci_for_watsonx"},{"vendor":"vmware","product":"fusion"}],"references":[{"url":"https://www.ibm.com/support/pages/node/7244646","tags":["vendor-advisory","patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-36222"},{"url":"https://github.com/advisories/GHSA-g96v-hcqx-rf45"}],"sources":{"cve":[{"id":"CVE-2025-36222","title":"IBM Fusion insecure default configuration","description":"IBM Fusion 2.2.0 through 2.10.1, IBM Fusion HCI 2.2.0 through 2.10.0, and IBM Fusion HCI for watsonx 2.8.2 through 2.10.0 uses insecure default configurations that could expose AMQStreams without client authentication that could allow an attacker to perform unauthorized actions.","status":"published","published":"2025-09-11T20:44:06.696Z","modified":"2026-02-26T17:48:40.895Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T14:32:45.105469Z"}],"euvd":[{"id":"EUVD-2025-28994","description":"IBM Fusion 2.2.0 through 2.10.1, IBM Fusion HCI 2.2.0 through 2.10.0, and IBM Fusion HCI for watsonx 2.8.2 through 2.10.0 uses insecure default configurations that could expose AMQStreams without client authentication that could allow an attacker to perform unauthorized actions.","status":"published","published":"2025-09-11T20:44:06Z","modified":"2026-02-26T17:48:40Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:48:21.697838Z"}],"ghsa":[{"id":"GHSA-g96v-hcqx-rf45","title":"IBM Fusion 2.2.0 through 2.10.1, IBM Fusion HCI 2.2.0 through 2.10.0, and IBM Fusion HCI for...","description":"IBM Fusion 2.2.0 through 2.10.1, IBM Fusion HCI 2.2.0 through 2.10.0, and IBM Fusion HCI for watsonx 2.8.2 through 2.10.0 uses insecure default configurations that could expose AMQStreams without client authentication that could allow an attacker to perform unauthorized actions.","status":"published","published":"2025-09-11T21:31:55Z","modified":"2025-09-11T21:32:01Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T15:03:34.910007Z"}],"nvd":[{"id":"CVE-2025-36222","description":"IBM Fusion 2.2.0 through 2.10.1, IBM Fusion HCI 2.2.0 through 2.10.0, and IBM Fusion HCI for watsonx 2.8.2 through 2.10.0 uses insecure default configurations that could expose AMQStreams without client authentication that could allow an attacker to perform unauthorized actions.","status":"published","published":"2025-09-11T21:15:34.35Z","modified":"2026-10-18T21:10:00.12Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T14:11:28.834562Z"}]}}