6.8
/ 10
MEDIUM
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Description
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 under specific configuration of cataloged remote storage aliases could allow an authenticated user to execute unauthorized commands due to an authorization bypass vulnerability using a user-controlled key.
Basic Information
ID
CVE-2025-36365
Source
ibm
Published
Jan 30, 2026 at 21:27
Modified
Jan 30, 2026 at 21:40
Affected Product
Vendor
IBM
Product
Db2 for Linux, UNIX and Windows
Version
11.5.0
Affected Versions
IBM Db2 for Linux, UNIX and Windows 11.5.0
IBM Db2 for Linux, UNIX and Windows 12.1.0
IBM Db2 for Linux, UNIX and Windows 12.1.0