Account Lockout Weakness in IBM DevOps Plan 3.0.x
CVE-2025-36363

5.9MEDIUM

Key Information:

Vendor

IBM
Status
Devops Plan
Vendor
CVE Published:
3 March 2026

What is CVE-2025-36363?

IBM DevOps Plan versions 3.0.0 through 3.0.5 suffer from an inadequate account lockout configuration that permits remote attackers to conduct brute force attacks on user account credentials. This vulnerability can lead to unauthorized access and potential data breaches if not addressed. It is crucial for users of affected versions to apply the necessary security patches to mitigate this risk.

Affected Version(s)

DevOps Plan 3.0.0 <= 3.0.5

References

https://www.ibm.com/support/pages/node/7261934
vendor-advisorypatch

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.