Quick answers
- Is CVE-2025-36363 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-36363 being exploited in the wild.
- How severe is CVE-2025-36363?
- Medium severity, with a CVSS score of 5.9, published 3 March 2026.
- Which products and versions are affected?
- IBM DevOps Plan 3.0.0 - 3.0.5.
- Is there a fix for CVE-2025-36363?
- A patch was published on 2026-03-03: Fix available in version 3.0.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-36363 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2025-36363?
- Check whether you run IBM DevOps Plan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
IBM DevOps Plan is vulnerable to improper restriction of excessive authentication attempts (CWE-307). The vulnerability exists because the account lockout settings are inadequately configured, failing to prevent automated brute-force attacks against user credentials. A remote, unauthenticated attacker can exploit this by repeatedly attempting to authenticate with different passwords for a known username. While the attack complexity is rated as high (likely due to the time required for brute-forcing or specific environmental configurations), a successful exploit results in unauthorized access to the platform. Users are advised to upgrade to version 3.0.6 to remediate the issue.
Affected products
- IBM DevOps Plan 3.0.0 - 3.0.5
Timeline
- 2026-02-26: advisory: Initial publication by IBM
- 2026-03-03: disclosed: NVD publication date
- 2026-03-03: patched: Fix available in version 3.0.6