CVE Alert: CVE-2025-36137 – IBM – Sterling Connect:Direct for Unix

Risk verdict

High risk of privilege escalation due to misassigned maintenance-task permissions in affected UNIX deployments; exploitation state and KEV/EPSS indicators are not provided.

Why this matters

Misplaced privileges for post-update scripts could let a privileged attacker extend their access or execute higher-privilege actions within the environment. The impact includes potential persistence, broader data access, and disruption of maintenance windows, affecting critical data transfers.

Most likely attack path

Network-based attempt to exploit a maintenance-task permission flaw, with the attacker needing high pre-existing privileges (PR: High) and no user interaction. An initial foothold or credential compromise would be followed by escalation via CCD-related tasks to run privileged scripts, enabling broader control without additional user actions.

Who is most exposed

Enterprises running Sterling Connect:Direct for Unix across data-transfer pipelines, typically with CCD accounts and maintenance scripts tied to privileged roles; organisations with broad CCD permissions or lax change-control over maintenance tasks are at greater risk.

Detection ideas

• Monitor for unusual or elevated permissions granted to CCD-maintenance tasks
• Detect executions of post-update scripts under CCD accounts outside normal maintenance windows
• Alert on new or elevated CCD user privileges or accounts
• Correlate maintenance-task activity with unexpected privilege elevations
• Audit and alert on iFix-related script changes or deployments outside approved change-control

Mitigation and prioritisation

• Apply fixed releases: upgrade to 6.4.0.2.iFix004, 6.3.0.5.iFix008, or 6.2.0.9.iFix005 as directed
• Enforce least privilege for CCD users; remove unnecessary post-update-task privileges
• Segment maintenance tasks; separate duties and implement strict change-control
• Validate patches in a test environment before production rollout; schedule during low-activity windows
• If KEV is confirmed or EPSS ≥ 0.5, treat as priority 1; otherwise treat as high priority.