CVE-2025-36038

CVE-2025-36038 is a critical remote code execution vulnerability affecting IBM WebSphere Application Server versions 8.5 and 9.0, as well as products from HP, IBM, Linux, Microsoft, and Oracle. This flaw, stemming from improper handling of serialized objects (CWE-502), allows an unauthenticated attacker to execute arbitrary code with high impact on confidentiality, integrity, and availability. With a CVSS score of 9.8 (CRITICAL) and a FAUCET Risk Score of 95/100, it presents a significant threat. The vulnerability has a network attack vector and low attack complexity, requiring no user interaction or privileges. While there is no evidence of active exploitation (KEV: No) and no public exploit code (Metasploit, Nuclei, ExploitDB: None), the vulnerability has garnered significant community discussion with two mentions, indicating awareness. Despite the lack of active exploits or public proof-of-concept code, the high severity and ease of exploitation warrant immediate attention and patching for affected systems. The low EPSS score, however, suggests a relatively low probability of exploitation in the wild compared to other CVEs.