CVE-2025-36247: 
IBM Db2 vulnerability analysis and mitigation

CVE-2025-36247 is an XML External Entity (XXE) injection vulnerability in IBM Db2 for Linux, UNIX, and Windows (including Db2 Connect Server) that allows unauthenticated remote attackers to expose sensitive information or consume memory resources. The vulnerability affects versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3. It was published on February 17, 2026, with a patch made available shortly after. It carries a CVSS v3.1 base score of 8.2 (High) (IBM Support, Red Hat CVE).

The root cause is classified as CWE-611 (Improper Restriction of XML External Entity Reference), where the IBM Db2 XML processing engine fails to properly restrict or disable external entity references embedded in XML input. An unauthenticated remote attacker can send crafted XML data containing malicious external entity declarations to the Db2 service over the network, triggering the parser to resolve external references. This can result in server-side file disclosure or memory exhaustion (XML entity expansion / "billion laughs" style attacks). No authentication, user interaction, or elevated privileges are required, and attack complexity is low (IBM Support, Red Hat CVE).

Successful exploitation can lead to unauthorized disclosure of sensitive information accessible to the Db2 process (high confidentiality impact), including database contents, configuration files, or OS-level files reachable via the server's file system. Additionally, attackers can cause memory resource exhaustion, resulting in degraded performance or denial of service (low availability impact). Integrity is not directly affected by this vulnerability (IBM Support).

1. Reconnaissance: Identify internet-facing or network-accessible IBM Db2 instances (versions 11.5.0–11.5.9 or 12.1.0–12.1.3) using network scanning tools such as Nmap or Shodan, targeting default Db2 ports (e.g., TCP 50000).
2. Craft malicious XML payload: Construct an XML document containing a malicious external entity declaration, such as:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>

3. Submit payload to Db2 XML processing interface: Send the crafted XML to any Db2 endpoint or API that accepts and processes XML input (e.g., via SQL/XML functions, stored procedures, or application interfaces that pass XML to Db2).
4. Retrieve exfiltrated data: If the server resolves the external entity, the contents of the referenced file (e.g., /etc/passwd) will be returned in the response or error output, exposing sensitive server-side information.
5. Denial of Service (optional): Alternatively, submit a recursive or deeply nested entity expansion payload to exhaust server memory resources (IBM Support).

• Network: Unusual or unexpected outbound connections from the Db2 server process to external hosts or internal file servers, particularly on ports 80, 443, or SMB (445); inbound XML-containing requests to Db2 service ports (e.g., TCP 50000) with DOCTYPE declarations.
• Logs: Db2 diagnostic logs (db2diag.log) showing XML parsing errors or unexpected external entity resolution attempts; application logs recording malformed or oversized XML inputs.
• Process: Db2 server process exhibiting abnormal memory consumption or CPU spikes consistent with entity expansion attacks.
• File System: Unexpected access to sensitive OS files (e.g., /etc/passwd, /etc/shadow, Windows SAM) by the Db2 service account as recorded in OS audit logs.

IBM has released patches for both affected version lines; administrators should upgrade IBM Db2 to a version beyond 11.5.9 (for the 11.5.x line) and beyond 12.1.3 (for the 12.1.x line) as detailed in the IBM support page. As interim mitigations, restrict network access to Db2 database ports (e.g., TCP 50000) to trusted hosts only using firewall rules. Additionally, implement XML parsing security controls at the application layer to disable external entity processing before data reaches Db2, and monitor Db2 diagnostic logs for anomalous XML processing activity (IBM Support).

Coverage of CVE-2025-36247 has been limited to automated vulnerability aggregators and security alert feeds. RedPacket Security published a CVE alert shortly after disclosure, and the vulnerability was noted in the Secret CISO newsletter. No significant researcher commentary, vendor blog posts, or broader media coverage has been identified beyond standard advisory republication (Red Hat CVE).