Introduction
Attackers who gain access to IBM InfoSphere Information Server can use a critical command injection flaw to escalate privileges and run arbitrary system commands. For organizations that rely on InfoSphere for enterprise data integration, the flaw puts core infrastructure at risk of compromise.
IBM InfoSphere Information Server is a flagship data integration and governance platform. Large enterprises deploy it widely for business intelligence, analytics, and regulatory compliance. Because it sits at the center of data processing pipelines, vulnerabilities in this product are especially damaging.
Technical Information
CVE-2025-36245 is a command injection vulnerability classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). It affects IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6, a wide range of releases.
The root cause is improper validation of user-supplied input in authenticated areas of the application. An attacker with valid credentials can submit crafted input containing shell metacharacters. The application does not properly sanitize that input before passing it to OS command execution functions, so the attacker can run arbitrary commands with elevated privileges. The result can be full system compromise.
Public sources include no code snippets, no proof of concept (PoC), no detection methods, and no patch details.
Affected Systems and Versions
- Product: IBM InfoSphere Information Server
- Versions: 11.7.0.0 through 11.7.1.6
- Configurations: all configurations running these versions are vulnerable
Vendor Security History
IBM InfoSphere Information Server has a documented history of high-severity vulnerabilities, including:
- CVE-2022-22454: OS command injection
- CVE-2025-25045: Sensitive information disclosure
- CVE-2025-1499: Cleartext storage of credentials
- CVE-2025-3221: Denial of service
- CVE-2025-0966: SQL injection
IBM usually publishes structured security bulletins and patches. Even so, the recurrence of similar issues suggests that secure development practices for this product line still have gaps.
