CVE-2025-36328: IBM watsonx.data Information Disclosure

CVE-2025-36328 Overview

CVE-2025-36328 is an information disclosure vulnerability affecting IBM watsonx.data intelligence versions 5.2.0, 5.2.1, 5.2.2, and 5.3.0. The flaw stems from detailed technical error messages returned to the browser [CWE-209]. A remote authenticated attacker can obtain sensitive information about the underlying system through these verbose error responses. The disclosed information can support reconnaissance and enable further attacks against the platform.

Critical Impact
Authenticated remote attackers can harvest sensitive system information from verbose error messages returned by IBM watsonx.data intelligence, aiding follow-on attacks.

Affected Products

IBM watsonx.data intelligence 5.2.0
IBM watsonx.data intelligence 5.2.1
IBM watsonx.data intelligence 5.2.2
IBM watsonx.data intelligence 5.3.0

Discovery Timeline

2026-06-30 - CVE-2025-36328 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2025-36328

Vulnerability Analysis

CVE-2025-36328 falls under Generation of Error Message Containing Sensitive Information [CWE-209]. IBM watsonx.data intelligence returns detailed technical error messages directly in the browser response. These messages can expose stack traces, internal file paths, framework versions, database identifiers, or configuration details.

An attacker with low-privilege authenticated access can trigger error conditions through crafted inputs or unexpected request parameters. The application then responds with diagnostic content intended for developers rather than production users. The exposed metadata narrows the attack surface enumeration required for follow-on exploitation.

The vulnerability requires network access and low privileges without user interaction. Confidentiality is affected while integrity and availability remain untouched. The EPSS probability is 0.359% with a percentile of 27.89.

Root Cause

The root cause is improper error handling in the watsonx.data intelligence web tier. Exception and diagnostic output that should be logged server-side is instead rendered to the client. Production error responses are not sanitized to remove implementation details.

Attack Vector

An authenticated attacker sends malformed or unexpected input to application endpoints. The server generates an exception and returns a detailed technical error page to the browser. The attacker parses the response to extract internal paths, component versions, or query fragments useful for chaining attacks.

No verified exploit code is publicly available. See the IBM Support Page for vendor technical details.

Detection Methods for CVE-2025-36328

Indicators of Compromise

HTTP 4xx or 5xx responses from watsonx.data intelligence endpoints containing stack traces, class names, or file system paths.
Repeated malformed requests from a single authenticated session probing multiple API endpoints.
Unusual response body sizes on error status codes suggesting verbose diagnostic content.

Detection Strategies

Inspect application and reverse proxy logs for response bodies containing keywords such as Exception, Traceback, at java., or internal hostnames.
Correlate authenticated sessions generating high ratios of error responses to successful requests.
Baseline normal error volume per user role and alert on deviations that indicate enumeration behavior.

Monitoring Recommendations

Forward watsonx.data intelligence access and application logs to a centralized analytics platform for query and correlation.
Track requests that produce error responses larger than expected thresholds and route them to review queues.
Alert on outbound responses containing regex patterns matching stack traces, SQL fragments, or absolute file paths.

How to Mitigate CVE-2025-36328

Immediate Actions Required

Apply the fix documented on the IBM Support Page for watsonx.data intelligence versions 5.2.0 through 5.3.0.
Restrict watsonx.data intelligence access to trusted networks and authenticated users pending remediation.
Review recent authenticated session activity for reconnaissance behavior against affected endpoints.

Patch Information

IBM has published remediation guidance on its support portal. Administrators should consult the IBM Support Page for the fixed release identifier and upgrade instructions applicable to versions 5.2.0, 5.2.1, 5.2.2, and 5.3.0.

Workarounds

Configure the application server or reverse proxy to strip detailed error content and return generic error pages to clients.
Enable production mode settings that disable stack trace rendering in HTTP responses.
Deploy a web application firewall rule to block responses containing exception signatures until patches are applied.

bash

# Example reverse proxy configuration to suppress detailed error bodies
proxy_intercept_errors on;
error_page 500 502 503 504 /generic_error.html;
error_page 400 401 403 404 /generic_error.html;