CVE-2025-36059: IBM Business Automation Workflow RCE Flaw

CVE-2025-36059 Overview

CVE-2025-36059 is a privilege escalation vulnerability affecting IBM Business Automation Workflow containers and IBM Cloud Pak for Business Automation. The vulnerability allows a local user with access to the container to execute operating system calls, potentially compromising the integrity of the containerized environment. This flaw stems from execution with unnecessary privileges (CWE-250), where the container environment grants excessive permissions that can be abused by authenticated local attackers.

Critical Impact
Local users with container access can execute OS system calls, potentially modifying container configurations or performing unauthorized actions that affect system integrity.

Affected Products

IBM Business Automation Workflow containers 25.0.0 through 25.0.0 Interim Fix 002
IBM Business Automation Workflow containers 24.0.1 through 24.0.1 Interim Fix 005
IBM Business Automation Workflow containers 24.0.0 through 24.0.0 Interim Fix 006
IBM Cloud Pak for Business Automation (affected versions)

Discovery Timeline

January 20, 2026 - CVE-2025-36059 published to NVD
January 20, 2026 - Last updated in NVD database

Technical Details for CVE-2025-36059

Vulnerability Analysis

This vulnerability is classified under CWE-250 (Execution with Unnecessary Privileges), indicating that the affected container environments operate with elevated privileges beyond what is required for normal functionality. The attack requires local access to the container and low-level privileges to exploit, combined with a high attack complexity due to specific conditions that must be met. While the vulnerability does not impact confidentiality or availability, successful exploitation can lead to high impact on system integrity through unauthorized OS system call execution.

Root Cause

The root cause lies in the container configuration of IBM Business Automation Workflow and IBM Cloud Pak for Business Automation. The containers are configured with excessive privileges that allow local users to execute operating system calls that should be restricted. This represents a violation of the principle of least privilege, where containerized workloads should be isolated from the underlying host OS capabilities.

Attack Vector

The attack vector is local, requiring an attacker to have existing access to the container environment. The exploitation path involves:

Attaining local user access within the affected container
Identifying available system call capabilities granted by the container runtime
Leveraging the excessive privileges to execute OS-level operations
Potentially modifying system configurations or bypassing container isolation controls

The vulnerability mechanism involves improper seccomp profile configuration or excessive Linux capabilities granted to the container. When containers run with unnecessary privileges, local users can invoke system calls that would normally be blocked in a properly hardened container environment. This can allow actions such as modifying mount points, manipulating network configurations, or accessing kernel interfaces. For detailed technical information, refer to the IBM Support Page.

Detection Methods for CVE-2025-36059

Indicators of Compromise

Unexpected system call activity originating from container processes
Anomalous process execution or privilege escalation attempts within container workloads
Unauthorized modifications to container filesystem or configuration files
Suspicious audit log entries showing elevated capability usage

Detection Strategies

Monitor container runtime logs for unusual system call patterns using tools like auditd or Falco
Implement runtime security monitoring to detect privilege escalation attempts within containers
Review Kubernetes audit logs for unauthorized pod modifications or capability requests
Deploy SentinelOne Singularity Cloud Workload Security for real-time container threat detection

Monitoring Recommendations

Enable seccomp audit mode to log system calls without blocking to identify exploitation attempts
Configure alerting on container processes attempting to use capabilities beyond baseline
Implement network segmentation monitoring to detect lateral movement from compromised containers
Regularly audit container configurations for excessive Linux capabilities or privileged mode settings

How to Mitigate CVE-2025-36059

Immediate Actions Required

Review all IBM Business Automation Workflow container deployments for affected versions
Apply the latest interim fixes from IBM: 25.0.0 IF 003+, 24.0.1 IF 006+, or 24.0.0 IF 007+ as available
Restrict container access to only essential personnel until patches are applied
Implement additional seccomp profiles to limit available system calls

Patch Information

IBM has acknowledged this vulnerability and provides remediation guidance through their official support channels. Organizations should consult the IBM Support Page for specific patch availability and installation instructions. Ensure you update to versions beyond the affected interim fix ranges:

For version 25.0.0: Apply fixes beyond Interim Fix 002
For version 24.0.1: Apply fixes beyond Interim Fix 005
For version 24.0.0: Apply fixes beyond Interim Fix 006

Workarounds

Implement restrictive seccomp profiles to limit system calls available within containers
Drop unnecessary Linux capabilities using securityContext.capabilities.drop: ["ALL"] in Kubernetes pod specifications
Enable readOnlyRootFilesystem and runAsNonRoot security context settings
Use Pod Security Standards (Restricted) to enforce container hardening at the namespace level

bash

# Example Kubernetes security context configuration for hardening
# Apply to affected container deployments as a temporary mitigation
apiVersion: v1
kind: Pod
metadata:
  name: baw-hardened
spec:
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: baw-container
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL
      readOnlyRootFilesystem: true