IBM watsonx Orchestrate Vulnerability (CVE-2025-0165) Exposes Systems to SQL Injection Attacks

The security advisory warns of a SQL injection vulnerability in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data, tracked as CVE-2025-0165, with a CVSS score of 7.6. According to IBM, the flaw stems from insufficient sanitisation of SQL queries and could let a remote attacker view, add, modify or delete information in the back-end database.

IBM describes watsonx Orchestrate as “an intuitive, AI-powered platform that you can use to create, configure, and deploy intelligent agents that can automate business tasks,” underscoring the potential impact within enterprise environments. IBM confirmed affected versions are 4.8.4–4.8.5 and 5.0.0–5.2, leaving systems exposed until users apply the fix.

The advisory recommends upgrading to IBM watsonx Orchestrate Cartridge 5.2.0[.]1 and patching promptly, with patched versions available via the IBM Fix Central portal. The issue highlights the ongoing risk posed by SQL injection vectors in complex automation tools used across organisations. 31 August 2025