PT-2026-5452 · Ibm · Db2 For Linux+1

Publicado 2026-01-30 · Atualizado 2026-01-31 · CVE-2025-36365

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) versions 11.5.0 through 11.5.9 IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) versions 12.1.0 through 12.1.3

Description An authenticated user may be able to execute unauthorized commands due to an authorization bypass. This occurs when using a user-controlled key with a specific configuration of cataloged remote storage aliases.

Recommendations IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) versions 11.5.0 through 11.5.9 should be updated. IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) versions 12.1.0 through 12.1.3 should be updated.

Correção

LPE

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2025-36365

Produtos afetados

Db2 Connect Server

Db2 For Linux

Referências · 9

• https://cve.org/CVERecord?id=CVE-2025-36365 · Nota de Segurança
• https://t.me/CVEtracker/43335 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-36365 · Aviso do Fabricante
• https://ibm.com/support/pages/node/7257665 · Correção, Aviso do Fabricante
• https://ubuntu.com/security/CVE-2025-36365 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2017398233778032741 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-36365 · Nota de Segurança
• https://twitter.com/CVEnew/status/2017354532548743462 · Publicação no Twitter
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-36365 · Aviso do Fabricante