IBM Watsonx.data vulnerabilities

9 CVEs affecting IBM Watsonx.data, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-36145, published 2026-05-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-36143, published 2025-09-18. High severity, CVSS 7.2. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Lakehouse (watsonx.data 2.2) could allow an authenticated privileged user to execute arbitrary commands on the system due to improper validation of user supplied input.
CVE-2025-36140, published 2025-12-08. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM watsonx.data 2.2 through 2.2.1 could allow an authenticated user to cause a denial of service through ingestion pods due to improper allocation of resources without limits.
CVE-2025-36146, published 2025-09-18. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Lakehouse (watsonx.data 2.2) could allow an authenticated user to obtain sensitive server component version information which could aid in further attacks against the system.
CVE-2025-36183, published 2026-02-17. Low severity, CVSS 2.7. EPSS: 0.2% chance of exploitation in the next 30 days. IBM watsonx.data 2.2 through 2.2.1 IBM Lakehouse could allow a privileged user to upload malicious files that could be executed server to modify limited files or data.
CVE-2025-36180, published 2026-04-30. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM watsonx.data 2.2 through 2.3 IBM Lakehouse does not properly restrict communication between pods which could allow an attacker to transfer data between pods without restrictions.
CVE-2025-36139, published 2025-09-18. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Lakehouse (watsonx.data 2.2) is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2025-36145, published 2026-05-26. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM watsonx.data 2.2 through 2.3.1 IBM Lakehouse does not properly restrict inbound and outbound connections which could allow an attacker to transfer or modify files without restrictions.
CVE-2025-36144, published 2025-09-27. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. IBM Lakehouse (watsonx.data 2.2) stores potentially sensitive information in log files that could be read by a local user.
CVE-2025-36335, published 2026-04-30. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.3.0, 5.3.1 stores user credentials in plain text which can be read by a local user.