CVE-2025-12985 HIGH

CVE-2025-12985: License Service: Privilege escalation vulnerability

Vendor Ibm
Product IBM Licensing Operator
Weakness CWE-732
Published January 20, 2026
Last update January 20, 2026
View on NVD All CVEs

CVSS base score

8.4/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

IBM Licensing Operator incorrectly assigns privileges to security critical files which could allow a local root escalation inside a container running the IBM Licensing Operator image.

Key dates

02Disclosure timeline

January 20, 2026 CVE published
January 20, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-44201 Junos OS and Junos OS Evolved: A local attacker can retrieve sensitive information and elevate privileges on the device to an authorized user. CVE-2026-26929 Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata CVE-2025-59961 Junos OS and Junos OS Evolved: Unix socket used to control the jdhcpd process is world-writable CVE-2025-52923 CVE-2025-21325 Windows Secure Kernel Mode Elevation of Privilege Vulnerability