# CVE-2025-36220: IBM Cloud Pak for Data System SQL injection in Cyclops

Source: https://junglewise.ai/threats/cve-2025-36220-ibm-cloud-pak-for-data-system-sql-injection-in-cyclops  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2025-36220 · Severity: medium · CVSS 4.3 · Published 2026-05-26

IBM Cloud Pak for Data System is an integrated data and analytics platform. A security vulnerability in the Cyclops component allows an authenticated user to perform SQL injection attacks. This could allow an attacker to unauthorizedly view, modify, or delete sensitive information stored in the platform's back-end database, potentially compromising data integrity.

Technologies: [IBM Cloud Pak for Data System](https://junglewise.ai/threats/technologies/cloud-pak-for-data-system). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2025-36220 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-36220 being exploited in the wild.

**How severe is CVE-2025-36220?** Medium severity, with a CVSS score of 4.3, published 26 May 2026.

**Which products and versions are affected?** IBM Cloud Pak for Data System 11.3.0.2 through 11.3.0.2-IF2.

**Is there a fix for CVE-2025-36220?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-36220 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-36220?** Check whether you run IBM Cloud Pak for Data System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability (CWE-89) exists in the Cyclops component of IBM Cloud Pak for Data System versions 11.3.0.2 through 11.3.0.2-IF2. The flaw stems from improper neutralization of special elements used in SQL commands. A remote attacker with low-level privileges can exploit this by sending specially crafted SQL statements to the application. Successful exploitation allows the attacker to view, add, modify, or delete information within the back-end database. The issue is addressed in version 11.3.1.1 (Fix ID: 11.3.1.1-WS-ICPDS-CYCLOPS-fp278500).

## Affected products

- IBM Cloud Pak for Data System - Cyclops 11.3.0.2 through 11.3.0.2-IF2

## Timeline

- 2026-05-25: disclosed: Initial publication by IBM
- 2026-05-26: advisory: NVD publication date

## References

- [https://www.ibm.com/support/pages/node/7273923](https://www.ibm.com/support/pages/node/7273923)

## Related threats

- [IBM Cloud Pak for Data System arbitrary file access via incorrect permissions](https://junglewise.ai/threats/cve-2026-3684-ibm-cloud-pak-for-data-system-11-3-1-2-interim-fix-001-through-11)
- [IBM Cloud Pak for Data System weak cryptographic protocols](https://junglewise.ai/threats/cve-2026-17467-ibm-cloud-pak-for-data-system-weak-cryptographic-protocols)
- [IBM Cloud Pak for Data System log injection](https://junglewise.ai/threats/cve-2026-14350-ibm-cloud-pak-for-data-system-log-injection)
- [IBM Cloud Pak for Data System denial of service](https://junglewise.ai/threats/cve-2026-3686-ibm-cloud-pak-for-data-system-denial-of-service)
- [IBM Cloud Pak for Data System default passwords in Cyclops](https://junglewise.ai/threats/cve-2025-36221-ibm-cloud-pak-for-data-system-default-passwords-in-cyclops)