Log in Start free

Vulnerability · Published Dec 15, 2025 · Assigned by ibm

CVE-2025-36360IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an Insufficient Session Expiration vulnerability

Medium 5.0

In plain English

A medium-severity security flaw in UCD - IBM DevOps Deploy from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium
Exploit odds (30 days)0.2%top 91.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

IBM UCD - IBM UrbanCode Deploy 7.1 through 7.1.2.27, 7.2 through 7.2.3.20, and 7.3 through 7.3.2.15 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.10, and 8.1 through 8.1.2.3 is susceptible to a race condition in http-session client-IP binding enforcement which may allow a session to be briefly reused from a new IP address before it is invalidated, potentially enabling unauthorized access under certain network conditions.

Affected products (as reported)

VendorProductVersions
IBM UCD - IBM UrbanCode Deploy 7.1 – through 7.1.2.277.2 – through 7.2.3.207.3 – through 7.3.2.15
IBM UCD - IBM DevOps Deploy 8.0 – through 8.0.1.108.1 – through 8.1.2.3

Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

References