CVE-2025-1837: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge

Q: Who can exploit this issue?

An authenticated user can exploit the improper trust of server-side permission methods to perform unauthorized actions. The provided data does not identify any required privilege level beyond being authenticated.

Q: Which versions are identified as affected?

For the Cloud Pak for Data 4.8 release line, versions 4.8.4 through 4.8.5 are affected. For the 5.x release line, versions 5.0.0 through 5.4.2 are affected.

Q: Is user interaction required for exploitation?

Yes. The supplied CVSS vector includes UI:R, indicating that user interaction is required. The vector also indicates network-based attack access and low attack complexity.

Published Oct 23, 2026

Updated

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods.

Other sources

IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods.

— IBM

Affected Software

2 affected components

IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data<=4.8.4-4.8.5

IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data<=5.0.0-5.4.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM watsonx Orchestrate Cartridge to a version that resolves this vulnerability.
Fixed in 5.4.4

Event History

Oct 23, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 8, 2026

CVE Published

via MITRE·03:57 PM

Data Sourced

via MITRE·03:57 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7293785

Frequently Asked Questions

Who can exploit this issue?

An authenticated user can exploit the improper trust of server-side permission methods to perform unauthorized actions. The provided data does not identify any required privilege level beyond being authenticated.

Which versions are identified as affected?

For the Cloud Pak for Data 4.8 release line, versions 4.8.4 through 4.8.5 are affected. For the 5.x release line, versions 5.0.0 through 5.4.2 are affected.

Is user interaction required for exploitation?

Yes. The supplied CVSS vector includes UI:R, indicating that user interaction is required. The vector also indicates network-based attack access and low attack complexity.

CVE-2025-1837: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who can exploit this issue?

Which versions are identified as affected?

Is user interaction required for exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which versions are identified as affected?

Is user interaction required for exploitation?