# CVE-2025-36363: IBM DevOps Plan brute force vulnerability in authentication

Source: https://junglewise.ai/threats/cve-2025-36363-ibm-devops-plan-brute-force-vulnerability-in-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-03. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2025-36363 · Severity: medium · CVSS 5.9 · Published 2026-03-03

IBM DevOps Plan, a tool used for managing software development lifecycles, contains a security flaw in its login mechanism. The software does not properly lock accounts after multiple failed login attempts, which could allow an attacker to guess user passwords through automated trial-and-error. If successful, an attacker could gain unauthorized access to the development environment and sensitive project data.

Technologies: [IBM DevOps Plan](https://junglewise.ai/threats/technologies/devops-plan). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2025-36363 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-36363 being exploited in the wild.

**How severe is CVE-2025-36363?** Medium severity, with a CVSS score of 5.9, published 3 March 2026.

**Which products and versions are affected?** IBM DevOps Plan 3.0.0 - 3.0.5.

**Is there a fix for CVE-2025-36363?** A patch was published on 2026-03-03: Fix available in version 3.0.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-36363 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-36363?** Check whether you run IBM DevOps Plan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

IBM DevOps Plan is vulnerable to improper restriction of excessive authentication attempts (CWE-307). The vulnerability exists because the account lockout settings are inadequately configured, failing to prevent automated brute-force attacks against user credentials. A remote, unauthenticated attacker can exploit this by repeatedly attempting to authenticate with different passwords for a known username. While the attack complexity is rated as high (likely due to the time required for brute-forcing or specific environmental configurations), a successful exploit results in unauthorized access to the platform. Users are advised to upgrade to version 3.0.6 to remediate the issue.

## Affected products

- IBM DevOps Plan 3.0.0 - 3.0.5

## Timeline

- 2026-02-26: advisory: Initial publication by IBM
- 2026-03-03: disclosed: NVD publication date
- 2026-03-03: patched: Fix available in version 3.0.6

## References

- [https://www.ibm.com/support/pages/node/7261934](https://www.ibm.com/support/pages/node/7261934)

## Related threats

- [IBM DevOps Plan HTTP header injection in HOST headers](https://junglewise.ai/threats/cve-2026-4096-ibm-devops-plan-http-header-injection-in-host-headers)
- [IBM DevOps Plan sensitive information disclosure in web cache](https://junglewise.ai/threats/cve-2025-36364-ibm-devops-plan-sensitive-information-disclosure-in-web-cache)