CVE-2025-36174: IBM Integrated Analytics System RCE Flaw

CVE-2025-36174 Overview

CVE-2025-36174 affects IBM Integrated Analytics System versions 1.0.0.0 through 1.0.30.0. The vulnerability allows an authenticated user to upload a file of a dangerous type that another user can execute when opened. The flaw is classified as Unrestricted Upload of File with Dangerous Type [CWE-434]. IBM published a security advisory tracking the issue under support node 7242970.

The vulnerability requires authentication and user interaction to trigger execution. Successful exploitation impacts confidentiality, integrity, and availability of the analytics system and downstream user workstations.

Critical Impact
An authenticated attacker can stage malicious files within the platform. A second user opening the file triggers code execution in that user's context, enabling lateral movement and credential theft.

Affected Products

IBM Integrated Analytics System 1.0.0.0
IBM Integrated Analytics System versions 1.0.1.0 through 1.0.29.0
IBM Integrated Analytics System 1.0.30.0

Discovery Timeline

2025-08-24 - CVE-2025-36174 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36174

Vulnerability Analysis

The IBM Integrated Analytics System fails to validate the type of files submitted through its upload functionality. An authenticated user can place a file with a dangerous extension or content type into shared storage accessible to other platform users. When a second user opens that file, the host application or operating system executes the embedded payload.

The attack chain combines two weaknesses. First, the application accepts uploads without enforcing an allowlist of safe MIME types or extensions. Second, downstream consumers render or open the file without sandboxing. The result is arbitrary code execution under the privileges of the opening user.

This class of flaw frequently enables credential theft, persistence on analyst workstations, and pivot to backend databases reachable from the analytics platform.

Root Cause

The root cause is missing or incomplete server-side validation of uploaded file types [CWE-434]. The application trusts client-supplied metadata or relies on extension checks that attackers can bypass. Files such as macro-enabled documents, HTML applications, or scripts pass through the upload pipeline and reach other users intact.

Attack Vector

The attack vector is network-based and requires low-privilege authentication. The attacker uploads a weaponized file through the standard interface. Exploitation completes when a different authenticated user opens the file, which establishes the user-interaction requirement.

No public proof-of-concept exploit is available. CVE-2025-36174 is not listed in the CISA Known Exploited Vulnerabilities catalog. See the IBM Support Page for vendor technical details.

// No verified exploitation code is available.
// Refer to the IBM advisory for technical specifics.

Detection Methods for CVE-2025-36174

Indicators of Compromise

Files with executable, script, or macro-enabled extensions stored in IBM Integrated Analytics System shared workspaces or notebook directories.
Unexpected child processes (such as cmd.exe, powershell.exe, wscript.exe, or shell interpreters) spawned by analytics client applications or browser processes that opened platform-hosted files.
Outbound network connections from analyst workstations to unfamiliar hosts immediately after opening files retrieved from the platform.
Audit log entries showing uploads from low-privilege accounts followed by access from privileged users.

Detection Strategies

Inspect IBM Integrated Analytics System upload logs for non-standard file types and correlate upload events with later download or open events by other accounts.
Deploy endpoint behavioral analytics to flag office or browser processes that launch script interpreters after opening files originating from the analytics platform.
Hash uploaded files and compare against threat intelligence feeds before they are made available to other users.

SentinelOne Singularity Endpoint applies behavioral AI to identify anomalous process chains, such as document or browser processes spawning script interpreters, which is the dominant execution pattern for this vulnerability class.

Monitoring Recommendations

Enable verbose audit logging on the IBM Integrated Analytics System for all file upload, share, and download operations.
Forward platform logs and endpoint telemetry to a SIEM and alert on cross-user file access within short time windows.
Track per-user upload volumes and file-type distributions to baseline normal activity and surface outliers.

How to Mitigate CVE-2025-36174

Immediate Actions Required

Apply the IBM security update referenced in the IBM Support Page to all instances running versions 1.0.0.0 through 1.0.30.0.
Audit existing uploads stored in shared workspaces for files with executable or script extensions and quarantine suspicious artifacts.
Review platform accounts and revoke upload privileges for users who do not require them.

Patch Information

IBM has issued remediation guidance through its support portal. Administrators should consult the IBM Support Page for the fixed version and upgrade procedure applicable to their deployment.

Workarounds

Restrict upload permissions to a minimum set of trusted users until the patch is deployed.
Implement a network or proxy filter that strips or blocks dangerous file types from being downloaded from the analytics platform.
Configure endpoint policy to prevent office and browser applications from launching script interpreters or unsigned executables.

bash

# Example: identify high-risk extensions in a shared upload directory
find /opt/ibm/ias/shared -type f \
  \( -iname "*.exe" -o -iname "*.hta" -o -iname "*.js" \
     -o -iname "*.vbs" -o -iname "*.ps1" -o -iname "*.scr" \
     -o -iname "*.docm" -o -iname "*.xlsm" \) \
  -printf "%T+ %u %p\n" | sort