CVE-2025-36335 — IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.3.0, 5.3.1
CVE-2025-36335 — IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.3.0, 5.3.1 stores user credentials in plain text which can be read by a local user.
What This Means For You
- If your environment is affected by CWE-256, review your exposure and prioritize patching based on your environment. Monitor vendor advisories for CVE-2025-36335 updates and patches.
Related ATT&CK Techniques
🛡️ Detection Rules
2 rules · 6 SIEM formats2 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2025-36335 - IBM watsonx.data Plaintext Credentials Access
title: CVE-2025-36335 - IBM watsonx.data Plaintext Credentials Access
id: scw-2026-04-30-ai-1
status: experimental
level: high
description: |
Detects local file access to configuration files within IBM watsonx.data that are known to store user credentials in plain text, as described in CVE-2025-36335. This indicates a local attacker has likely obtained sensitive credentials.
author: SCW Feed Engine (AI-generated)
date: 2026-04-30
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2025-36335/
tags:
- attack.credential_access
- attack.t1003
logsource:
category: file_access
detection:
selection:
TargetFilename|contains:
- '/opt/watsonxdata/conf/config.yaml'
- '/opt/watsonxdata/conf/settings.yaml'
EventType:
- 'file_read'
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2025-36335 | vulnerability | CVE-2025-36335 |
| CWE-256 | weakness | CWE-256 |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 01, 2026 at 01:16 UTC |
This content was curated and summarized by Shimi's Cyber World for informational purposes. It is not copied or republished in full. All intellectual property rights remain with the original author and source.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-7551: HKUDS OpenHarness RCE Flaw Exposes Sensitive Data
CVE-2026-7551 — HKUDS OpenHarness contains a remote code execution vulnerability in the /bridge slash command that allows remote senders accepted by configuration to execute arbitrary...
CVE-2026-7503: Remote Buffer Overflow in code-projects Plugin
CVE-2026-7503 — A vulnerability was detected in code-projects for Plugin 4.1.2cu.5137. The impacted element is the function setWiFiMultipleConfig in the library /lib/cste_modules/wireless.so of the file...
CVE-2026-7502 — LinkStackOrg LinkStack Vulnerability
CVE-2026-7502 — A security vulnerability has been detected in LinkStackOrg LinkStack up to 4.8.6. The affected element is the function saveLink of the file app/Http/Controllers/UserController.php...