← Vulnerability feed

Vulnerability record · CVE-2025-36026 · published 28 June 2025

CVE-2025-36026: Ibm datacap vulnerability

Ibm · Datacap

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.

4.3 CVSS 3.1 Medium EPSS 0.15% · top 96.4% CWE-614 · CWE-614
4.3CVSS 3.1 base score
0.15%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.ibm.com/support/pages/node/7238443 Vendor Advisory

Track CVE-2025-36026 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-39736Ibm datacap vulnerabilityIBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to HTTP header injection, caused by improper validation of input by the HOS…EPSS 0.37%8.8CVE-2020-4902Ibm datacap navigator sql injection vulnerabilityIBM Datacap Taskmaster Capture (IBM Datacap Navigator 9.1.7) is vulnerable to SQL injection. A remote attacker could send specially crafted SQL state…EPSS 0.97%7.5CVE-2026-8636Ibm datacap vulnerabilityIBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve user passwords and cryptographic…EPSS 0.20%7.5CVE-2024-39731Ibm datacap broken cryptographic algorithm vulnerabilityIBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 uses weaker than expected cryptographic algorithms that could allow an attacker to decryp…EPSS 0.28%7.5CVE-2024-39732Ibm datacap cleartext storage of sensitive data vulnerabilityIBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 temporarily stores data from different environments that could be obtained by a malicious…EPSS 0.19%6.1CVE-2026-8059Ibm datacap cross-site scripting vulnerabilityIBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 is vulnerable to cross-site scripting. This vulnerability allow…EPSS 0.24%5.5CVE-2024-39733Ibm datacap insufficiently protected credentials vulnerabilityIBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 stores user credentials in plain clear text which can be read by a local user. IBM X-Forc…EPSS 0.14%5.4CVE-2025-36027Ibm datacap clickjacking vulnerabilityIBM Datacap 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a mali…EPSS 0.22%

Source: NIST National Vulnerability Database (record CVE-2025-36026), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.