PT-2025-25495 · Ibm · Ibm Mq Operator Sc2+2

Published 2025-06-13 · Updated 2025-08-22 · CVE-2025-36041

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM MQ Operator LTS versions 2.0.0 through 2.0.29 IBM MQ Operator CD versions 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1 through 3.5.3 IBM MQ Operator SC2 versions 3.2.0 through 3.2.12

Description The issue allows the Native HA CRR to be configured with a private key and chain other than the intended key. This could disclose sensitive information or allow an attacker to perform unauthorized actions.

Recommendations For IBM MQ Operator LTS versions 2.0.0 through 2.0.29, update to a version that includes the fix for this issue. For IBM MQ Operator CD versions 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, update to a version that includes the fix for this issue. For IBM MQ Operator SC2 versions 3.2.0 through 3.2.12, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Native HA CRR configuration to minimize the risk of exploitation.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2025-07294

CVE-2025-36041

Affected Products

Ibm Mq Operator

Ibm Mq Operator Lts

Ibm Mq Operator Sc2

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-36041 · Security Note
• https://osv.dev/vulnerability/CVE-2025-36041 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-07294 · Security Note
• https://t.me/cvetracker/26254 · Telegram Post
• https://t.me/cveNotify/133212 · Telegram Post
• https://t.me/cvenotify/125715 · Telegram Post
• https://ibm.com/support/pages/node/7236608 · Vendor Advisory, Patch
• https://twitter.com/byte_reaper/status/1935926922531250505 · Twitter Post
• https://twitter.com/CVEnew/status/1934243884055298469 · Twitter Post