Sensitive Information Exposure in IBM Db2 for Linux, UNIX and Windows
CVE-2025-36425

5.3MEDIUM

Key Information:

Vendor

IBM
Status
Db2 For Linux, Unix And Windows
Vendor
CVE Published:
17 February 2026

What is CVE-2025-36425?

The vulnerability affects IBM Db2 for Linux, UNIX and Windows, enabling authenticated users to access sensitive information due to misconfigurations within the HADR (High Availability Disaster Recovery) setup. This could potentially lead to unauthorized data exposure, impacting the confidentiality of stored information. It is crucial for users to review their configurations and apply necessary patches to mitigate this risk. For further details and remediation steps, please visit the official IBM advisory.

Affected Version(s)

Db2 for Linux, UNIX and Windows 11.5.0 <= 11.5.9

Db2 for Linux, UNIX and Windows 12.1.0 <= 12.1.3

References

https://www.ibm.com/support/pages/node/7259962
vendor-advisorypatch

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.