CVE-2025-36365

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-36365", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-04-15T21:16:55.332Z", "datePublished": "2026-01-30T21:27:54.160Z", "dateUpdated": "2026-02-26T15:04:41.178Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:linux:*:*", "cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:unix:*:*", "cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:aix:*:*", "cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:windows:*:*", "cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:zos:*:*", "cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:linux:*:*", "cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:unix:*:*", "cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:aix:*:*", "cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:windows:*:*", "cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:zos:*:*", "cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:linux:*:*", "cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:unix:*:*", "cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:aix:*:*", "cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:windows:*:*", "cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:zos:*:*", "cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:linux:*:*", "cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:unix:*:*", "cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:aix:*:*", "cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:windows:*:*", "cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:zos:*:*"], "defaultStatus": "unaffected", "product": "Db2 for Linux, UNIX and Windows", "vendor": "IBM", "versions": [{"lessThanOrEqual": "11.5.9", "status": "affected", "version": "11.5.0", "versionType": "semver"}, {"lessThanOrEqual": "12.1.3", "status": "affected", "version": "12.1.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 under specific configuration of cataloged remote storage aliases could allow an authenticated user to execute unauthorized commands due to an authorization bypass vulnerability using a user-controlled key.</p><br>"}], "value": "IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 under specific configuration of cataloged remote storage aliases could allow an authenticated user to execute unauthorized commands due to an authorization bypass vulnerability using a user-controlled key."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-01-30T21:40:05.499Z"}, "references": [{"tags": ["vendor-advisory", "patch"], "url": "https://www.ibm.com/support/pages/node/7257665"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Customers running any vulnerable modpack level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, and V12.1.2. They can be applied to any affected level of the appropriate release to remediate this vulnerability.</p><p>&nbsp;</p><div><table><tbody><tr><td><strong>Release</strong></td><td><strong>Fixed in mod pack</strong></td><td><strong>APAR</strong></td><td><strong>Download URL</strong></td></tr><tr><td>V11.5</td><td>TBD</td><td><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/mysupport/s/defect/aCIgJ0000005WX7/dt451268\">DT451268</a></td><td><p>Special Build #66394 or later for V11.5.9 available at this link:<br><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/node/7087189\">https://www.ibm.com/support/pages/node/7087189</a></p></td></tr><tr><td><p>V12.1</p></td><td><p>TBD</p></td><td><p><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/mysupport/s/defect/aCIgJ0000005WX7/dt451268\">DT451268</a></p></td><td><p>Special Build #72296 or later for V12.1.2 available at this link:<br><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads\">https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads</a></p></td></tr></tbody></table></div><br><br>"}], "value": "Customers running any vulnerable modpack level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, and V12.1.2. They can be applied to any affected level of the appropriate release to remediate this vulnerability.\n\n\u00a0\n\nReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 \n\nV12.1\n\nTBD\n\n https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads"}], "source": {"discovery": "UNKNOWN"}, "title": "IBM Db2 Privilege Escalation", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-36365", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-31T04:56:24.456015Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:04:41.178Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-36365", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-31T04:56:24.456015Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-02T16:07:50.764Z"}}], "cna": {"title": "IBM Db2 Privilege Escalation", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:linux:*:*", "cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:unix:*:*", "cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:aix:*:*", "cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:windows:*:*", "cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:zos:*:*", "cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:linux:*:*", "cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:unix:*:*", "cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:aix:*:*", "cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:windows:*:*", "cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:zos:*:*", "cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:linux:*:*", "cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:unix:*:*", "cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:aix:*:*", "cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:windows:*:*", "cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:zos:*:*", "cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:linux:*:*", "cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:unix:*:*", "cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:aix:*:*", "cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:windows:*:*", "cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:zos:*:*"], "vendor": "IBM", "product": "Db2 for Linux, UNIX and Windows", "versions": [{"status": "affected", "version": "11.5.0", "versionType": "semver", "lessThanOrEqual": "11.5.9"}, {"status": "affected", "version": "12.1.0", "versionType": "semver", "lessThanOrEqual": "12.1.3"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Customers running any vulnerable modpack level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, and V12.1.2. They can be applied to any affected level of the appropriate release to remediate this vulnerability.\n\n\u00a0\n\nReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 \n\nV12.1\n\nTBD\n\n https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads", "supportingMedia": [{"type": "text/html", "value": "<p>Customers running any vulnerable modpack level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, and V12.1.2. They can be applied to any affected level of the appropriate release to remediate this vulnerability.</p><p>&nbsp;</p><div><table><tbody><tr><td><strong>Release</strong></td><td><strong>Fixed in mod pack</strong></td><td><strong>APAR</strong></td><td><strong>Download URL</strong></td></tr><tr><td>V11.5</td><td>TBD</td><td><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/mysupport/s/defect/aCIgJ0000005WX7/dt451268\">DT451268</a></td><td><p>Special Build #66394 or later for V11.5.9 available at this link:<br><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/node/7087189\">https://www.ibm.com/support/pages/node/7087189</a></p></td></tr><tr><td><p>V12.1</p></td><td><p>TBD</p></td><td><p><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/mysupport/s/defect/aCIgJ0000005WX7/dt451268\">DT451268</a></p></td><td><p>Special Build #72296 or later for V12.1.2 available at this link:<br><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads\">https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads</a></p></td></tr></tbody></table></div><br><br>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7257665", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 under specific configuration of cataloged remote storage aliases could allow an authenticated user to execute unauthorized commands due to an authorization bypass vulnerability using a user-controlled key.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 under specific configuration of cataloged remote storage aliases could allow an authenticated user to execute unauthorized commands due to an authorization bypass vulnerability using a user-controlled key.</p><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-01-30T21:40:05.499Z"}}}, "cveMetadata": {"cveId": "CVE-2025-36365", "state": "PUBLISHED", "dateUpdated": "2026-02-02T16:07:53.540Z", "dateReserved": "2025-04-15T21:16:55.332Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-01-30T21:27:54.160Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:linux:*:*", "cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:unix:*:*", "cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:aix:*:*", "cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:windows:*:*", "cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:zos:*:*", "cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:linux:*:*", "cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:unix:*:*", "cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:aix:*:*", "cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:windows:*:*", "cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:zos:*:*", "cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:linux:*:*", "cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:unix:*:*", "cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:aix:*:*", "cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:windows:*:*", "cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:zos:*:*", "cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:linux:*:*", "cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:unix:*:*", "cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:aix:*:*", "cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:windows:*:*", "cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:zos:*:*"], "defaultStatus": "unaffected", "product": "Db2 for Linux, UNIX and Windows", "vendor": "IBM", "versions": [{"lessThanOrEqual": "11.5.9", "status": "affected", "version": "11.5.0", "versionType": "semver"}, {"lessThanOrEqual": "12.1.3", "status": "affected", "version": "12.1.0", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:db2:*:*:*:*:*:linux:*:*", "matchCriteriaId": "ECAF5576-B4A5-4DB7-94F0-942F656F0461", "versionEndIncluding": "11.5.9", "versionStartIncluding": "11.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:db2:*:*:*:*:*:unix:*:*", "matchCriteriaId": "B1E165E8-F11B-4F13-B54A-90D29CA2ABF8", "versionEndIncluding": "11.5.9", "versionStartIncluding": "11.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:db2:*:*:*:*:*:windows:*:*", "matchCriteriaId": "727E2804-2D3D-4C31-A3E5-F99107D02A27", "versionEndIncluding": "11.5.9", "versionStartIncluding": "11.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:db2:*:*:*:*:*:linux:*:*", "matchCriteriaId": "2AA1764B-CD82-4B33-B85B-27CA2F7C0ED5", "versionEndIncluding": "12.1.3", "versionStartIncluding": "12.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:db2:*:*:*:*:*:unix:*:*", "matchCriteriaId": "8F63D92C-AC19-4FB0-A605-08DC01875E7B", "versionEndIncluding": "12.1.3", "versionStartIncluding": "12.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:db2:*:*:*:*:*:windows:*:*", "matchCriteriaId": "E28DCDF3-EF5B-47D6-BD38-C98334B67BE4", "versionEndIncluding": "12.1.3", "versionStartIncluding": "12.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 under specific configuration of cataloged remote storage aliases could allow an authenticated user to execute unauthorized commands due to an authorization bypass vulnerability using a user-controlled key."}, {"lang": "es", "value": "IBM Db2 para Linux, UNIX y Windows (incluye Db2 Connect Server) 11.5.0 - 11.5.9 y 12.1.0 - 12.1.3 bajo una configuraci\u00f3n espec\u00edfica de alias de almacenamiento remoto catalogados podr\u00eda permitir a un usuario autenticado ejecutar comandos no autorizados debido a una vulnerabilidad de omisi\u00f3n de autorizaci\u00f3n usando una clave controlada por el usuario."}], "id": "CVE-2025-36365", "lastModified": "2026-06-17T09:14:40.520", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.2, "source": "psirt@us.ibm.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-36365", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-31T04:56:24.456015Z", "version": "2.0.3"}}]}, "published": "2026-01-30T22:15:54.127", "references": [{"source": "psirt@us.ibm.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7257665"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{}