CVE-2025-36099

🗓️ 29 Sep 2025 18:20:09Reported by ibmType

CVE-2025-36099 causes denial of service in WebSphere Application Server 8.5 and 9.0 via a crafted request.

Reporter	Title	Published	Views	Family All 25
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by a denial of service	3 Oct 202512:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed WebSphere Application Server traditional which is affected by a denial of service (CVE-2025-36099)	3 Oct 202507:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server is affected by a denial of service (CVE-2025-36099)	29 Sep 202515:58	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Buinses Automation Workflow (CVE-2025-36099)	1 Oct 202517:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is affected by a denial of service (CVE-2025-36099)	10 Oct 202516:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Test Management is affected by a denial of service due to WebSphere Application Server traditional.	15 Nov 202505:23	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability has been identified in WebSphere Application Server shipped with WebSphere Service Registry and Repository (CVE-2025-36099)	2 Oct 202516:12	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Enterprise Application Runtimes, is affected by a denial of service (CVE-2025-36099)	10 Oct 202516:50	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2025-36099)	18 Feb 202613:58	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM DevOps Code ClearCase (CVE-2025-36099, CVE-2025-7962)	21 Nov 202506:44	–	ibm

NVD

Vulners

Node

ibm websphere_application_serverMatch8.5.0.0

ibm websphere_application_serverMatch9.0.0.0

[
  {
    "cpes": [
      "cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "product": "WebSphere Application Server",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "8.5"
      },
      {
        "status": "affected",
        "version": "9.0"
      }
    ]
  }
]

Source	Link
ibm	www.ibm.com/support/pages/node/7246549

03 Oct 2025 17:54Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.14.9

EPSS0.00066

SSVC

CWE-770