CVE-2025-36367: 
NixOS vulnerability analysis and mitigation

IBM i versions 7.6, 7.5, 7.4, 7.3, and 7.2 are affected by a privilege escalation vulnerability (CVE-2025-36367) discovered and disclosed on November 1, 2025. The vulnerability is caused by an invalid IBM i SQL services authorization check that affects the host operating system (IBM Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is categorized under CWE-862 (Missing Authorization), indicating a fundamental security control issue in the authorization mechanism of IBM i SQL services (IBM Advisory).

The vulnerability allows a malicious actor to exploit elevated privileges of another user profile to gain root access to the host operating system, potentially leading to complete system compromise (IBM Advisory).

IBM has released security patches for all affected versions. The fixes are available through specific PTF numbers: 7.6 (SJ07552, SJ07650, SJ07651, SJ07652), 7.5 (SJ07553, SJ07653, SJ07654, SJ07655), 7.4 (SJ07554, SJ07656, SJ07657, SJ07658), 7.3 (SJ07555, SJ07659, SJ07660, SJ07661), and 7.2 (SJ07556, SJ07662, SJ07663, SJ07664). IBM strongly recommends addressing the vulnerability immediately (IBM Advisory).