← Vulnerability feed

Vulnerability record · CVE-2025-36418 · published 20 January 2026

CVE-2025-36418: Ibm applinx improper verification of cryptographic signature vulnerability

Ibm · Applinx

IBM ApplinX 11.1 is vulnerable due to a privilege escalation vulnerability due to improper verification of JWT tokens. An attacker may be able to craft or modify a JSON web token in order to impersonate another user or to elevate their privileges.

9.8 CVSS 3.1 Critical EPSS 0.17% · top 94.3% CWE-347 · Improper verification of cryptographic signature
9.8CVSS 3.1 base score
0.17%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

IBM ApplinX 11.1 is vulnerable due to a privilege escalation vulnerability due to improper verification of JWT tokens. An attacker may be able to craft or modify a JSON web token in order to impersonate another user or to elevate their privileges.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.ibm.com/support/pages/node/7257446 Vendor Advisory

Track CVE-2025-36418 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

6.5CVE-2024-49800Ibm applinx cleartext storage of sensitive data vulnerabilityIBM ApplinX 11.1 stores sensitive information in cleartext in memory that could be obtained by an authenticated user.EPSS 0.20%6.4CVE-2025-36408Ibm applinx cross-site scripting vulnerabilityIBM ApplinX 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in …EPSS 0.19%5.9CVE-2024-49797Ibm applinx broken cryptographic algorithm vulnerabilityIBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Securi…EPSS 0.25%5.4CVE-2025-36409Ibm applinx cross-site scripting vulnerabilityIBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web…EPSS 0.17%5.4CVE-2024-49796Ibm applinx clickjacking vulnerabilityIBM ApplinX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a r…EPSS 0.41%5.4CVE-2024-49791Ibm applinx cross-site scripting vulnerabilityIBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web…EPSS 0.22%5.4CVE-2024-49792Ibm applinx cross-site scripting vulnerabilityIBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web…EPSS 0.22%5.4CVE-2024-49793Ibm applinx cross-site scripting vulnerabilityIBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web…EPSS 0.22%

Source: NIST National Vulnerability Database (record CVE-2025-36418), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.