CVE-2025-36323 is a CWE-79 cross-site scripting vulnerability affecting IBM watsonx.data intelligence versions 5.2.0, 5.2.1, 5.2.2, and 5.3.0. The vulnerability permits an authenticated user to embed arbitrary JavaScript code in the web UI, which can alter intended functionality and may lead to the disclosure of credentials within a trusted session. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial confidentiality and integrity impact. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

An authenticated attacker can exploit this vulnerability to inject malicious scripts into the web interface of IBM watsonx.data intelligence. This can lead to altered application behavior and potential disclosure of user credentials within the session, compromising confidentiality and integrity. Availability is not impacted. The medium severity rating reflects the need for authentication and user interaction for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated user privileges to trusted personnel only and monitor for suspicious activity related to web UI interactions. Avoid exposing the affected versions to untrusted networks where possible.