CVE-2025-3356 is a High (CVSS 8.6) path traversal flaw in IBM Tivoli Monitoring 6.3.0.7 through Service Pack 21. A remote attacker could view, overwrite or append to arbitrary files. IBM points to a remediation technote, and says the problem is avoided when agents use TLS only.
What's affected
The record and IBM's bulletin list IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 21. The bulletin ties the issue to the KT1 component of ITM and ITCAM agents, which can read from and write to the local file system. That facility supports features such as the Self-Describing Agent, which pushes application support file updates through the monitoring environment.
IBM did not publish a new service pack level in the bulletin. It tells customers to follow the steps in a technote titled "Remediation of CVE-2025-3355 and CVE-2025-3356". Check that technote on IBM's site for the exact steps for your release, because this post does not reproduce them.
A sibling CVE, CVE-2025-3355, appears in the same bulletin. It is a read-only variant rated 7.5, while this one also allows writing and appending.
How to check if you're exposed
This is a commercial product, so exposure is a matter of inventory and configuration.
- Identify every Tivoli Monitoring agent host and note the version and service pack level. Anything from 6.3.0.7 up to and including SP21 is in scope.
- Find out how each agent is configured for communication. IBM's bulletin says the vulnerability is avoided when an agent is configured to use only TLS. Agents that still accept non-TLS connections are the ones to prioritise.
- Check which agent ports are reachable from outside your management network. The record shows a network attack vector with low complexity and no authentication.
- Open the IBM technote and confirm the steps match your platform before you schedule changes.
What to do now
- Read IBM's bulletin and the remediation technote for CVE-2025-3355 and CVE-2025-3356.
- Apply the remediation steps to every affected agent, starting with agents reachable from untrusted segments.
- Where your policy allows it, configure agents to use TLS only. IBM states this avoids the vulnerability.
- Limit network paths to agent ports to the monitoring servers that need them.
- Review file integrity logs on agent hosts for unexpected changes to configuration or application support files, since the flaw allows writes.
Why it matters
The weakness is CWE-22, improper limitation of a pathname to a restricted directory. The agent builds a file path from a request without keeping it inside the intended folder, so sequences that step up the directory tree can reach files elsewhere on the host. IBM describes the entry point as a specially crafted URL request containing dot dot sequences.
The impact goes past reading files. Because the same facility can write and append, a successful attacker could change files the agent trusts. The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Does using TLS only fix this?
IBM's bulletin says the vulnerability is avoided when an agent is configured to use only TLS. It still tells customers to follow the remediation technote, so do both.
Which versions are affected?
IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 21, per the record and the IBM bulletin.
Sources
- IBM security bulletin: path traversal in IBM Tivoli Monitoring
- Gold vulnerability page for CVE-2025-3356
- Free in-browser dependency scan
Last reviewed: 18 October 2026.
