CVE-2026-3856

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3856", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-03-09T20:48:18.685Z", "datePublished": "2026-03-17T22:20:14.968Z", "dateUpdated": "2026-03-18T20:15:13.762Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-03-17T22:22:43.825Z"}, "title": "IBM Db2 Recovery Expert Missing Integrity Check", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-353", "description": "CWE-353 Missing support for integrity check", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "Db2 Recovery Expert", "versions": [{"status": "affected", "version": "5.5 IF 2"}], "defaultStatus": "unaffected", "cpes": ["cpe:2.3:a:ibm:db2_recovery_expert:5.5:if2:*:*:*:windows:*:*", "cpe:2.3:a:ibm:db2_recovery_expert:5.5:if2:*:*:*:unix:*:*", "cpe:2.3:a:ibm:db2_recovery_expert:5.5:if2:*:*:*:linux:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 could allow an attacker to modify or corrupt data due to an insecure mechanism used for verifying the integrity of the data during transmission.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 could allow an attacker to modify or corrupt data due to an insecure mechanism used for verifying the integrity of the data during transmission.<br>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7266272", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "solutions": [{"lang": "en", "value": "Upgrade to DB2 Recovery Expert for Linux, Unix and Windows v5.5.0.1 Interim Fix 8 available on Fix Central\u00a0 here https://www.ibm.com/support/fixcentral/swg/selectFixes .", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div><p>Upgrade to DB2 Recovery Expert for Linux, Unix and Windows v5.5.0.1 Interim Fix 8 available on Fix Central&nbsp;<a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EInformation%20Management&amp;product=ibm/Information+Management/DB2+Recovery+Expert+for+Linux+UNIX+and+Windows&amp;release=5.5.0.1&amp;platform=All&amp;function=all\" rel=\"nofollow\">here</a>.</p></div>"}]}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-18T20:15:02.658665Z", "id": "CVE-2026-3856", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T20:15:13.762Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3856", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-18T20:15:02.658665Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T20:15:09.716Z"}}], "cna": {"title": "IBM Db2 Recovery Expert Missing Integrity Check", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:db2_recovery_expert:5.5:if2:*:*:*:windows:*:*", "cpe:2.3:a:ibm:db2_recovery_expert:5.5:if2:*:*:*:unix:*:*", "cpe:2.3:a:ibm:db2_recovery_expert:5.5:if2:*:*:*:linux:*:*"], "vendor": "IBM", "product": "Db2 Recovery Expert", "versions": [{"status": "affected", "version": "5.5 IF 2"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to DB2 Recovery Expert for Linux, Unix and Windows v5.5.0.1 Interim Fix 8 available on Fix Central\u00a0 here https://www.ibm.com/support/fixcentral/swg/selectFixes .", "supportingMedia": [{"type": "text/html", "value": "<div><p>Upgrade to DB2 Recovery Expert for Linux, Unix and Windows v5.5.0.1 Interim Fix 8 available on Fix Central&nbsp;<a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EInformation%20Management&amp;product=ibm/Information+Management/DB2+Recovery+Expert+for+Linux+UNIX+and+Windows&amp;release=5.5.0.1&amp;platform=All&amp;function=all\" rel=\"nofollow\">here</a>.</p></div>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7266272", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 could allow an attacker to modify or corrupt data due to an insecure mechanism used for verifying the integrity of the data during transmission.", "supportingMedia": [{"type": "text/html", "value": "IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 could allow an attacker to modify or corrupt data due to an insecure mechanism used for verifying the integrity of the data during transmission.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-353", "description": "CWE-353 Missing support for integrity check"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-03-17T22:22:43.825Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3856", "state": "PUBLISHED", "dateUpdated": "2026-03-18T20:15:13.762Z", "dateReserved": "2026-03-09T20:48:18.685Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-03-17T22:20:14.968Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:db2_recovery_expert:5.5:if2:*:*:*:windows:*:*", "cpe:2.3:a:ibm:db2_recovery_expert:5.5:if2:*:*:*:unix:*:*", "cpe:2.3:a:ibm:db2_recovery_expert:5.5:if2:*:*:*:linux:*:*"], "defaultStatus": "unaffected", "product": "Db2 Recovery Expert", "vendor": "IBM", "versions": [{"status": "affected", "version": "5.5 IF 2"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:db2_recovery_expert:5.5.0:interim_fix_002:*:*:*:linux:*:*", "matchCriteriaId": "00292A98-B842-40DC-9C42-166072D8F762", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:db2_recovery_expert:5.5.0:interim_fix_002:*:*:*:unix:*:*", "matchCriteriaId": "7359808F-EE55-413C-A750-24B9E152B4D8", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:db2_recovery_expert:5.5.0:interim_fix_002:*:*:*:windows:*:*", "matchCriteriaId": "32ECD97B-CCDD-4848-88CF-5250FCF63685", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 could allow an attacker to modify or corrupt data due to an insecure mechanism used for verifying the integrity of the data during transmission."}, {"lang": "es", "value": "IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 podr\u00eda permitir a un atacante modificar o corromper datos debido a un mecanismo inseguro utilizado para verificar la integridad de los datos durante la transmisi\u00f3n."}], "id": "CVE-2026-3856", "lastModified": "2026-06-17T10:44:20.843", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "psirt@us.ibm.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3856", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-18T20:15:02.658665Z", "version": "2.0.3"}}]}, "published": "2026-03-17T23:16:17.647", "references": [{"source": "psirt@us.ibm.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7266272"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-353"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.5 IF 2"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Db2 Recovery Expert", "source": "cna", "vendor": "IBM"}, "product": "db2_recovery_expert", "vendor": "ibm"}], "analysis": {"en": {"generated_at": "2026-03-19T15:31:41.066197+00:00", "value": {"mitigation_remediation": ["Apply the vendor-provided Interim Fix\u00a08 and upgrade to DB2 Recovery Expert for Linux, Unix and Windows v5.5.0.1", "Verify the patch has been successfully applied and that the system is running the fixed version", "Monitor system logs for any unexpected data modifications or transmission anomalies"], "summary": {"action": "Apply Patch", "impact": "Data Integrity Compromise"}, "threat_synthesis": {"affected_systems": "IBM Db2 Recovery Expert for Linux, Unix and Windows, version 5.5 IF\u202f2. The affected builds are reflected in the CPEs for version 5.5.0 and 5.5 IF\u202f2 across all supported operating systems.", "description_and_impact": "The vulnerability arises from an insecure mechanism used by IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF\u202f2 to verify the integrity of data during transmission, which could allow an attacker to modify or corrupt data. The weakness corresponds to CWE\u2011353, reflecting a failure to protect data authenticity and integrity. Consequently, an attacker could potentially alter stored information, leading to incorrect database recovery or loss of reliable backup data.", "risk_and_exploitability": "The assessed CVSS score is 5.3, indicating moderate severity, while the EPSS score is less than 1\u202f%, suggesting a low likelihood of exploitation. The vulnerability is not listed in CISA\u2019s KEV catalog. The attack vector is inferred to be an exploitation of the data transmission path used by the software, although the description does not explicitly detail the attacker\u2019s entry method."}}}}, "created": "2026-03-18T10:42:41.003114+00:00", "updated": "2026-03-24T10:54:29.768293+00:00", "vendors": ["ibm", "ibm$PRODUCT$db2_recovery_expert"]}