CVE-2025-36038

Critical · 9.8

CVSS

9.8

EPSS

13.3%

Published

Jun 25, 2025

CISA due date

—

The record

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects.

Affected packages

Ecosystem	Package	Introduced	Fixed