CVE-2025-36157 is a critical (CVSS 9.8) incorrect authorization flaw in IBM Jazz Foundation, part of IBM Engineering Lifecycle Management. An unauthenticated remote attacker could update server property files. Install the -sec iFix for your line, then close the RegistrationHandlerService setting.
What's affected
IBM's bulletin lists these releases of the Jazz Foundation based products:
- 7.0.2 through 7.0.2 iFix035
- 7.0.3 through 7.0.3 iFix018
- 7.1.0 through 7.1.0 iFix004
Affected products named by IBM include Jazz Foundation, Engineering Test Management, Engineering Workflow Management, Requirements Management DOORS Next, Engineering Insights, Rhapsody Model Manager, Jazz Reporting Service and Global Configuration Management. IBM says the issue could lead to a denial of service condition.
Customers on 7.0, 7.0.1 or anything below 7.0.2 are told to upgrade to maintenance release 7.0.2 first. The record does not mark the flaw as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
How to check if you're exposed
- Find your version in the application admin pages or the product version information.
- Compare it with the list above, including the iFix level.
- Check the setting named "RegistrationHandlerService is open" under Advanced Properties of each application admin page. In the teamserver.properties file the matching property is com.ibm.team.repository.setup.setup.isRegistrationHandlerServiceOpen.
- Review which of these servers are reachable from outside your network. A source and requirements server should rarely be open to the internet.
- Look the CVE up in the Gold directory and run the free in-browser dependency scan at gold.safeguard.sh/scan on any custom extensions.
What to do now
- Install the fix for your line: 7.0.2 iFix035-sec, 7.0.3 iFix018-sec or 7.1.0 iFix004-sec, or a later one.
- Complete IBM's additional step, which applies to all applications. Either use the admin page and set "RegistrationHandlerService is open" to False and save, or edit teamserver.properties and set the property above to False.
- Restart as IBM instructs and confirm the setting held.
- Restrict network access to these servers to the people who use them.
- Review server property files for changes you did not make.
IBM lists no workarounds or mitigations beyond the fix and the setting change.
Why it matters
The class is CWE-863, incorrect authorization. A function that should require proof of identity or a role can be reached without it. Here that function is the ability to change server property files.
Property files steer how a server behaves. Changing them without logging in can open the door to further unauthorized actions, which is why IBM requires a configuration change on top of installing the fix. Skipping that step leaves a gap.
Engineering lifecycle servers hold design records, requirements and source of product teams, making them attractive targets.
Quick check
Is installing the iFix enough?
No. IBM also tells you to set RegistrationHandlerService is open to False, in the admin page or in teamserver.properties.
What if I run a version below 7.0.2?
IBM recommends upgrading to maintenance release 7.0.2 first, or optionally to 7.1.0 with its fix.
Sources
Last reviewed: 18 October 2026.
