CVE-2025-36020: 
IBM Guardium Appliance vulnerability analysis and mitigation

IBM Guardium Data Protection version 11.5 contains a security vulnerability (CVE-2025-36020) that could allow remote attackers to obtain sensitive information due to cleartext transmission of sensitive credential information. The vulnerability was disclosed on August 6, 2025, and received a CVSS v3.1 base score of 5.9 (Medium) from IBM Corporation (IBM Advisory).

The vulnerability is classified as CWE-319 (Cleartext Transmission of Sensitive Information). The CVSS vector string is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating that the vulnerability is network accessible (AV:N), requires high attack complexity (AC:H), needs no privileges (PR:N), requires no user interaction (UI:N), has unchanged scope (S:U), and can result in high confidentiality impact (C:H) with no impact on integrity (I:N) or availability (A:N) (NVD).

The vulnerability allows remote attackers to obtain sensitive information by intercepting credential information that is transmitted in cleartext. This could potentially lead to unauthorized access to sensitive data or systems (IBM Advisory).

IBM has released security fixes for Guardium Data Protection 11.5. Customers are encouraged to update their systems promptly through IBM Fix Central. No temporary workarounds or mitigations have been identified (IBM Advisory).