CVE-2025-36186: fallo de gravedad alta en IBM Db2
IBM Db2 privilege escalation
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.4epss 0.1%
IBM Db2 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) under specific configurations could allow a local user to execute malicious code that escalate their privileges to root due to execution of unnecessary privileges operated at a higher than minimum level.
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
IBM · Db2CVEs relacionadas — IBM Db2
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-10109CRITICALIBM® Db2® is vulnerable to remote code execution due to improper pre-auth DRDA handshake handlingEPSS 0.9%CVE-2026-15955HIGHIBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file pathsEPSS 0.5%CVE-2026-86093HIGHIBM® Db2® federated server could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands under certain conditionsEPSS 0.5%CVE-2026-16702MEDIUMIBM® Db2® federated server could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereferenceEPSS 0.5%CVE-2026-17463MEDIUMIBM® Db2® could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumptionEPSS 0.5%CVE-2026-11906MEDIUMIBM® Db2® federated server is vulnerable to a denial of service due to improper neutralization of special elements in the data query logic of XMLTable-derived columns by autheticated userEPSS 0.4%