High severity · published Sep 18, 2025
CVE-2025-36143
IBM watsonx.data command execution
7.2
CVSS
0.3%
EPSS
No
On KEV
Description
IBM Lakehouse (watsonx.data 2.2) could allow an authenticated privileged user to execute arbitrary commands on the system due to improper validation of user supplied input.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
watsonx.data · IBM
2.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-36143
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-36143
Vendor Advisory
https://www.ibm.com/support/pages/node/7245379
More from watsonx.data
7.5
CVE-2025-36180
Inadequate Pod Communication Restrictions, affects watsonx.data
6.5
CVE-2025-36140
IBM watsonx.data Denial of Service
5.5
CVE-2025-36335
Vulnerabilities found
5.5
CVE-2025-36144
IBM watsonx.data information disclosure
5.3
CVE-2025-36145
Multiple Vulnerabilities in watsonx.data