CVE-2025-36064 Overview
CVE-2025-36064 affects IBM Sterling Connect:Express for Microsoft Windows versions 3.1.0.0 through 3.1.0.22. The product implements an inadequate account lockout setting that fails to restrict repeated failed authentication attempts. A remote attacker can leverage this weakness to brute force account credentials over the network. The flaw maps to CWE-307, Improper Restriction of Excessive Authentication Attempts. IBM published a security bulletin describing the impacted versions and the corrective update.
Critical Impact
Remote attackers can attempt unlimited credential guesses against exposed Connect:Express instances, leading to account takeover and unauthorized access to managed file transfer workflows.
Affected Products
- IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0
- IBM Sterling Connect:Express for Microsoft Windows versions 3.1.0.1 through 3.1.0.21
- IBM Sterling Connect:Express for Microsoft Windows 3.1.0.22
Discovery Timeline
- 2025-09-22 - CVE-2025-36064 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-36064
Vulnerability Analysis
IBM Sterling Connect:Express is a managed file transfer product used to move sensitive business data between enterprise systems. The affected Windows builds ship with an account lockout policy that does not adequately restrict repeated authentication failures. Attackers reaching the authentication interface over the network can submit large volumes of credential guesses without triggering effective lockout, rate limiting, or session termination. Successful credential recovery grants access to file transfer accounts and their associated data flows. The advisory does not indicate authenticated exploitation or user interaction is required to attempt the attack.
Root Cause
The root cause is an insufficient authentication throttling control classified under [CWE-307]. The application either sets the lockout threshold too high, resets counters too aggressively, or omits enforcement at the network authentication layer. As a result, the number of consecutive failed logins an attacker can attempt against a single account is not meaningfully bounded within a practical time window.
Attack Vector
Exploitation requires only network reachability to the Connect:Express authentication endpoint. An attacker enumerates valid usernames and iterates through password candidates using dictionaries, credential stuffing lists, or targeted guesses. Because lockout enforcement is inadequate, automated tooling can sustain guessing until a valid password is discovered. The attack complexity is elevated because successful compromise depends on password strength and username knowledge, but no privileges or user interaction are needed to conduct the attempts.
No public proof-of-concept code has been published for this issue. Refer to the IBM Support Page for vendor guidance.
Detection Methods for CVE-2025-36064
Indicators of Compromise
- Repeated failed authentication events for the same account within a short time window on Connect:Express services.
- Authentication attempts originating from unexpected source IP addresses, geographies, or non-corporate networks.
- Sudden successful logon following a burst of failed attempts, indicating possible credential guessing success.
Detection Strategies
- Correlate Connect:Express authentication logs to flag accounts exceeding a defined failure threshold per minute or per hour.
- Baseline normal login patterns for service and interactive accounts, then alert on deviations in volume or source.
- Ingest Connect:Express server and Windows security event logs into a centralized analytics platform for cross-source correlation.
Monitoring Recommendations
- Forward Connect:Express audit logs and Windows Event IDs 4625 and 4740 to a SIEM for continuous review.
- Monitor firewall and reverse proxy logs for unusual connection rates to Connect:Express listener ports.
- Track and review any account that transitions from many failures to a successful authentication, and validate with the account owner.
How to Mitigate CVE-2025-36064
Immediate Actions Required
- Apply the fixed version identified in the IBM Support Page advisory.
- Restrict network exposure of Connect:Express authentication interfaces to trusted management networks and VPN segments.
- Rotate credentials for any account that has been reachable from untrusted networks, prioritizing administrative and service accounts.
Patch Information
IBM has published remediation guidance on the IBM Support Page for CVE-2025-36064. Administrators running Sterling Connect:Express for Microsoft Windows versions 3.1.0.0 through 3.1.0.22 should upgrade to the fixed release identified by IBM. Validate the upgrade in a staging environment before promoting to production file transfer nodes to avoid disruption of scheduled transfers.
Workarounds
- Place Connect:Express behind a network gateway that enforces IP allow-listing and connection rate limiting until patching is complete.
- Enforce strong password policies and require unique, high-entropy credentials for every Connect:Express account.
- Enable multi-factor authentication where supported by the deployment architecture, and disable or remove unused accounts.
# Example: rate limit inbound connections to Connect:Express listener with Windows Firewall
# Adjust port to match your Connect:Express configuration
New-NetFirewallRule -DisplayName "Restrict Connect:Express Access" `
-Direction Inbound `
-Protocol TCP `
-LocalPort 6000 `
-RemoteAddress 10.0.0.0/24,10.0.1.0/24 `
-Action Allow
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
