CVE-2025-36271: CWE-759 Use of a One-Way Hash without a Salt in IBM Integrated Analytics System

CVE-2025-36271 describes a cryptographic weakness in IBM Integrated Analytics System versions 1.0.0.0 through 1.0.31.0 where a one-way hash function is used without a salt. This use of unsalted hashing constitutes CWE-759 and results in weaker than expected cryptographic protection, potentially enabling attackers to decrypt sensitive data. The vulnerability has a CVSS 3.1 score of 5.9 with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality only. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

The vulnerability impacts confidentiality by potentially allowing attackers to decrypt highly sensitive information due to the use of unsalted one-way hashes and weaker cryptographic algorithms. There is no impact on integrity or availability reported. The attack complexity is high, and no privileges or user interaction are required for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation is currently available, organizations should monitor IBM advisories for updates. Avoid relying on the affected versions for processing highly sensitive data until a fix is released.