PT-2025-35826 · Ibm · Transformation Advisor

Mike Whale · Published 2025-09-03 · Updated 2026-05-23 · CVE-2025-36193

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Transformation Advisor versions 2.0.1 through 4.3.1

Description IBM Transformation Advisor incorrectly assigns privileges to security critical files. This could allow a local root escalation within a container running the IBM Transformation Advisor Operator Catalog image.

Recommendations Apply necessary privilege restrictions to security critical files in IBM Transformation Advisor versions 2.0.1 through 4.3.1.

Fix

LPE

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2025-36193

Affected Products

Transformation Advisor

References · 6

• https://osv.dev/vulnerability/CVE-2025-36193 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-36193 · Security Note
• https://twitter.com/CVEnew/status/1963319273691947214 · Twitter Post
• https://t.me/CVEtracker/31628 · Telegram Post
• https://twitter.com/HugoValters/status/2058252330374475996 · Twitter Post
• https://ibm.com/support/pages/node/7243632 · Patch, Vendor Advisory