Vulnerability · Published Jun 15, 2025 · Assigned by ibm

CVE-2025-36041IBM MQ improper certificate validation

Medium 4.7

In plain English

A medium-severity improper certificate validation in MQ Operator from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.4%top 70.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, and MQ Operator SC2 3.2.0 through 3.2.12 Native HA CRR could be configured with a private key and chain other than the intended key which could disclose sensitive information or allow the attacker to perform unauthorized actions.

Affected products (as reported)

Vendor	Product	Versions
IBM	MQ Operator	2.0.0 LTS – through 2.0.29 LTS3.0.0, 3.0.1, 3.1.0, 3.1.3, 3.4.0, 3.5.0, 3.5.1, 3.5.3 CD3.2.0 SC2 – through 3.2.10 SC2

Weakness: CWE-295 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N

References

https://www.ibm.com/support/pages/node/7236608 vendor-advisory, patch