CVE-2025-36356: IBM Security Verify Access Privilege Escalation

CVE-2025-36356 Overview

CVE-2025-36356 is a local privilege escalation vulnerability affecting IBM Security Verify Access and IBM Security Verify Access Docker deployments. The vulnerability exists because certain operations execute with more privileges than required, allowing a locally authenticated user to escalate their privileges to root.

This vulnerability is classified as CWE-250 (Execution with Unnecessary Privileges), indicating that the affected software runs with elevated permissions that are not required for its intended functionality. An attacker who has local access to a vulnerable system can exploit this flaw to gain complete administrative control.

Critical Impact

A locally authenticated attacker can escalate privileges to root, potentially gaining full control over the identity and access management infrastructure.

Affected Products

• IBM Security Verify Access 10.0.0.0 through 10.0.9.0
• IBM Security Verify Access 11.0.0.0 through 11.0.1.0
• IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0
• IBM Security Verify Access Docker 11.0.0.0 through 11.0.1.0
• IBM Verify Identity Access (all versions through 11.0.1.0)
• IBM Verify Identity Access Docker (all versions through 11.0.1.0)

Discovery Timeline

• October 6, 2025 - CVE-2025-36356 published to NVD
• December 15, 2025 - Last updated in NVD database

Technical Details for CVE-2025-36356

Vulnerability Analysis

This privilege escalation vulnerability stems from improper privilege management within the IBM Security Verify Access platform. The software executes certain operations with elevated privileges that exceed what is necessary for normal functionality, creating an opportunity for locally authenticated users to escalate their access rights.

The attack requires local access to the system, meaning an attacker must first gain a foothold on the target machine through legitimate credentials or another initial access vector. Once local access is established, the attacker can leverage the excessive privileges to elevate from a standard user context to root-level access.

The impact of successful exploitation is severe, as it affects the confidentiality, integrity, and availability of the system. Additionally, the vulnerability has a changed scope, meaning the impact extends beyond the vulnerable component itself—a compromised identity and access management system can affect all resources and users it protects.

Root Cause

The root cause of CVE-2025-36356 is CWE-250: Execution with Unnecessary Privileges. The IBM Security Verify Access software performs certain operations while running with elevated privileges that are not required for the specific task being performed. This violation of the principle of least privilege creates an attack surface that can be exploited for privilege escalation.

When software runs with more privileges than necessary, any vulnerability or unexpected behavior in that software can be leveraged to perform actions at the elevated privilege level rather than the intended user level.

Attack Vector

The attack vector for this vulnerability is local, requiring the attacker to have authenticated access to the affected system. The exploitation path involves:

1. An attacker gains local access to a system running vulnerable IBM Security Verify Access software
2. The attacker identifies processes or operations running with elevated privileges
3. The attacker manipulates these privileged operations to escalate from their current user context to root
4. With root access, the attacker has complete control over the identity management infrastructure

Due to the nature of this vulnerability (execution with unnecessary privileges), exploitation typically involves manipulating the environment or inputs to privileged processes to gain elevated access. The technical specifics of the exploitation mechanism are detailed in the IBM Security Advisory.

Detection Methods for CVE-2025-36356

Indicators of Compromise

• Unexpected processes running with root privileges that were initiated by non-privileged users
• Anomalous privilege changes in system audit logs
• Unauthorized modifications to system configuration files or sensitive directories
• Unusual user activity patterns on IBM Security Verify Access systems

Detection Strategies

• Monitor for privilege escalation attempts using auditd rules for setuid/setgid system calls
• Implement file integrity monitoring on critical IBM Security Verify Access configuration files
• Review authentication logs for suspicious local authentication patterns
• Deploy endpoint detection solutions capable of identifying privilege escalation techniques

Monitoring Recommendations

• Enable comprehensive audit logging on all IBM Security Verify Access deployments
• Configure SIEM alerts for root-level process spawning by non-administrative users
• Monitor Docker container privilege changes for containerized deployments
• Establish baseline behavior for normal system operations to detect anomalies

How to Mitigate CVE-2025-36356

Immediate Actions Required

• Identify all IBM Security Verify Access installations running versions 10.0.0.0 through 10.0.9.0 or 11.0.0.0 through 11.0.1.0
• Review local user access and restrict unnecessary accounts
• Implement network segmentation to limit lateral movement possibilities
• Enable enhanced audit logging to detect exploitation attempts

Patch Information

IBM has released security updates to address this vulnerability. Organizations should apply the appropriate patches for their version:

• For version 10.x: Apply fixes beyond 10.0.9.0 Interim Fix 2
• For version 11.x: Apply fixes beyond 11.0.1.0

Refer to the IBM Security Advisory for specific patch versions and download links.

Workarounds

• Restrict local system access to only essential administrative personnel
• Implement strict user account controls and multi-factor authentication for local access
• Run IBM Security Verify Access containers with minimal privileges using Docker security options
• Deploy additional monitoring and alerting for privilege escalation indicators while awaiting patching

# Docker security hardening example for IBM Security Verify Access containers
# Run containers with reduced privileges where possible
docker run --security-opt=no-new-privileges \
  --cap-drop=ALL \
  --cap-add=NET_BIND_SERVICE \
  --read-only \
  ibm/security-verify-access:latest