# CVE-2025-36054: IBM Business Automation Workflow containers 24.0.0 through 24.0.0-IF006, 24.0.1 through 24.0.1-IF004, 25.0.0 through…

Source: https://junglewise.ai/threats/cve-2025-36054-ibm-business-automation-workflow-containers-24-0-0-through-24-0-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-06  
License: CC BY 4.0 with a link back

CVE-2025-36054 · Severity: medium · CVSS 6.1 · Published 2025-11-06

IBM Business Automation Workflow containers 24.0.0 through 24.0.0-IF006, 24.0.1 through 24.0.1-IF004, 25.0.0 through 25.0.0-IF001 and IBM Business Automation Workflow traditional with Process Federation Server 24.0.0 through 24.0.1 and 25.0.0 are vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Technologies: [IBM Business Automation Workflow](https://junglewise.ai/threats/technologies/business-automation-workflow). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2025-36054 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-36054 being exploited in the wild.

**How severe is CVE-2025-36054?** Medium severity, with a CVSS score of 6.1, published 6 November 2025.

**Which products and versions are affected?** IBM Business Automation Workflow, IBM Process Federation Server. The advisory does not name versions.

**Is there a fix for CVE-2025-36054?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-36054?** Check whether you run IBM Business Automation Workflow or IBM Process Federation Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- IBM Business Automation Workflow
- IBM Process Federation Server

## Related threats

- [IBM Business Automation Workflow XML external entity injection](https://junglewise.ai/threats/cve-2026-12752-ibm-business-automation-workflow-xml-external-entity-injection)
- [IBM Business Automation Workflow missing authorization in import](https://junglewise.ai/threats/cve-2026-12742-ibm-business-automation-workflow-missing-authorization-in-import)
- [IBM Business Automation Workflow XML external entity injection](https://junglewise.ai/threats/cve-2026-12756-ibm-business-automation-workflow-xml-external-entity-injection)
- [IBM Business Automation Workflow XML Entity Injection in programming models](https://junglewise.ai/threats/cve-2026-13107-ibm-business-automation-workflow-xml-entity-injection-in)