# CVE-2025-36364: IBM DevOps Plan sensitive information disclosure in web cache

Source: https://junglewise.ai/threats/cve-2025-36364-ibm-devops-plan-sensitive-information-disclosure-in-web-cache  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-03. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2025-36364 · Severity: medium · CVSS 6.2 · Published 2026-03-03

IBM DevOps Plan, a tool used for managing software development lifecycles, contains a security flaw where sensitive information is stored in a local web cache. This could allow an unauthorized person with access to the same computer system to view private data or credentials belonging to another user. Organizations should update to the latest version to ensure sensitive data is not inadvertently exposed on shared workstations or servers.

Technologies: [IBM DevOps Plan](https://junglewise.ai/threats/technologies/devops-plan). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2025-36364 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-36364 being exploited in the wild.

**How severe is CVE-2025-36364?** Medium severity, with a CVSS score of 6.2, published 3 March 2026.

**Which products and versions are affected?** IBM DevOps Plan 3.0.0 - 3.0.5.

**Is there a fix for CVE-2025-36364?** A patch was published on 2026-03-03: Remediation via version 3.0.6 identified Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-36364 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2025-36364?** Check whether you run IBM DevOps Plan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

IBM DevOps Plan (versions 3.0.0 through 3.0.5) is vulnerable to sensitive information disclosure due to improper cache management (CWE-525). The application allows sensitive data, including information transmitted via REST API request query parameters, to be stored in the local web browser cache. An attacker with local access to the system can retrieve and read this cached data, potentially gaining access to sensitive user information or session details. The vulnerability is exploited locally without requiring special privileges or user interaction. IBM has released version 3.0.6 to remediate this issue.

## Affected products

- IBM DevOps Plan 3.0.0 - 3.0.5

## Timeline

- 2026-02-26: advisory: Initial publication by IBM
- 2026-03-03: disclosed: NVD publication date
- 2026-03-03: patched: Remediation via version 3.0.6 identified

## References

- [https://www.ibm.com/support/pages/node/7261930](https://www.ibm.com/support/pages/node/7261930)

## Related threats

- [IBM DevOps Plan HTTP header injection in HOST headers](https://junglewise.ai/threats/cve-2026-4096-ibm-devops-plan-http-header-injection-in-host-headers)
- [IBM DevOps Plan brute force vulnerability in authentication](https://junglewise.ai/threats/cve-2025-36363-ibm-devops-plan-brute-force-vulnerability-in-authentication)