Critical severity · published Feb 4, 2026
CVE-2025-13375
IBM Common Cryptographic Architecture Arbitrary Command Execution
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
IBM Common Cryptographic Architecture (CCA) 7.5.52 and 8.4.82 could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Common Cryptographic Architecture · IBM
7.5.52; 8.4.82 · source: vendor
I4
IBM 4769 Developers Toolkit · IBM
7.5.52 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13375
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-13375
www.ibm.com
https://www.ibm.com/support/pages/node/7259625
More from Common Cryptographic Architecture
7.5
CVE-2023-47150
IBM Common Cryptographic Architecture (CCA) 7.0.0 through 7.5.36 could allow a remote user to cause a denial of service due to incorrect data handling for certain types of AES…
6.5
CVE-2024-49823
IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 could allow an authenticated user to cause a denial of service in the Hardware Security Module (HSM) using a specially…
6.5
CVE-2024-22340
IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 could allow a remote attacker to obtain sensitive information during the creation of ECDSA signatures to perform a…
5.5
CVE-2022-22423
IBM Common Cryptographic Architecture (CCA 5.x MTM for 4767 and CCA 7.x MTM for 4769) could allow a local user to cause a denial of service due to improper input validation
3.7
CVE-2024-41760
IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 could allow an attacker to obtain sensitive information due to a timing attack during certain RSA operations