PT-2026-3623 · Ibm · Ibm Application Gateway

Published 2026-01-20 · Updated 2026-01-20 · CVE-2025-36397

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM Application Gateway versions 23.10 through 25.09

Description A remote attacker could inject malicious HTML code. When viewed, this code would be executed in the victim’s Web browser within the security context of the hosting site. The issue is an HTML injection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2025-36397

Affected Products

Ibm Application Gateway

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-36397 · Security Note
• https://osv.dev/vulnerability/CVE-2025-36397 · Vendor Advisory
• https://twitter.com/CVEnew/status/2013641572449988688 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2013736438387400907 · Twitter Post
• https://ibm.com/support/pages/node/7256857 · Patch, Vendor Advisory