CVE-2025-36145 identifies a vulnerability in IBM watsonx.data (versions 2.2 through 2.3.1) related to improper restriction of communication channels (CWE-923). The product does not adequately restrict inbound and outbound connections, potentially enabling an attacker with limited privileges to transfer or modify files beyond intended boundaries. This could lead to unauthorized data manipulation or exfiltration. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, no user interaction, and limited confidentiality and integrity impact.

An attacker with privileges could exploit this vulnerability to transfer or modify files without proper restrictions, potentially leading to unauthorized data alteration or leakage. The impact on confidentiality and integrity is limited, and there is no impact on availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented. Users should monitor IBM advisories for updates regarding patches or mitigations. Until a fix is available, restrict access to the affected versions and limit privileges to reduce risk.