← Vulnerability feed

Vulnerability record · CVE-2025-36074 · published 23 April 2026

CVE-2025-36074: Ibm security verify directory unrestricted file upload vulnerability

Ibm · Security Verify Directory

IBM Security Verify Directory (Container) 10.0.0 through 10.0.0.3 IBM Security Verify Directory could be vulnerable to malicious file upload by not validating file type. A privileged user could upload malicious files into the system that can be sent to victims for performing further attacks against the system.

7.2 CVSS 3.1 High EPSS 0.34% · top 75.2% CWE-434 · Unrestricted file upload
7.2CVSS 3.1 base score
0.34%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

IBM Security Verify Directory (Container) 10.0.0 through 10.0.0.3 IBM Security Verify Directory could be vulnerable to malicious file upload by not validating file type. A privileged user could upload malicious files into the system that can be sent to victims for performing further attacks against the system.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.ibm.com/support/pages/node/7268907 Vendor Advisory

Track CVE-2025-36074 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2022-32755Ibm security directory server xml injection vulnerabilityIBM Security Directory Server 6.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could …EPSS 0.71%8.8CVE-2024-51450Ibm security verify directory os command injection vulnerabilityIBM Security Verify Directory 10.0.0 through 10.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system by sendin…EPSS 1.1%7.8CVE-2025-1411Ibm security verify directory execution with unnecessary privileges vulnerabilityIBM Security Verify Directory Container 10.0.0.0 through 10.0.3.1 could allow a local user to execute commands as root due to execution with unnecess…EPSS 0.17%7.5CVE-2024-45650Ibm security verify directory vulnerabilityIBM Security Verify Directory 10.0 through 10.0.3 is vulnerable to a denial of service when sending an LDAP extended operation.EPSS 0.40%6.5CVE-2022-32753Ibm security verify directory inadequate encryption strength vulnerabilityIBM Security Verify Directory 10.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive info…EPSS 0.18%5.9CVE-2022-33161Ibm security directory integrator missing encryption vulnerabilityIBM Security Directory Server 6.4.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Stri…EPSS 0.43%5.3CVE-2022-32751Ibm security verify directory information exposure vulnerabilityIBM Security Verify Directory 10.0.0 could disclose sensitive server information that could be used in further attacks against the system. IBM X-Forc…EPSS 0.45%4.8CVE-2022-32754Ibm security verify directory cross-site scripting vulnerabilityIBM Security Verify Directory 10.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the…EPSS 0.32%

Source: NIST National Vulnerability Database (record CVE-2025-36074), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.