CVE-2025-36365: 
IBM Db2 vulnerability analysis and mitigation

CVE-2025-36365 is an authorization bypass vulnerability in IBM Db2 for Linux, UNIX and Windows (including Db2 Connect Server) that allows authenticated users to execute unauthorized commands via a user-controlled key under specific remote storage alias configurations. It affects versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 across Linux, UNIX, and Windows platforms. The vulnerability was published on January 30, 2026, with a patch made available by IBM. It carries a CVSS v3.1 base score of 7.5 (High) (IBM Advisory, Red Hat CVE).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), where the application relies on a key value that can be manipulated by an authenticated user to bypass access controls. The vulnerability is triggered only under a specific configuration involving cataloged remote storage aliases in Db2, meaning not all deployments are affected — only those with this feature configured. An authenticated, low-privileged network user can craft requests using a user-controlled key to bypass authorization checks and execute commands outside their permitted scope (IBM Advisory, Red Hat CVE).

Successful exploitation allows an authenticated attacker to execute unauthorized commands on the Db2 server, resulting in high impacts to confidentiality, integrity, and availability of the database system. Attackers can escalate privileges to access and modify sensitive data stored within Db2, potentially compromising business-critical information. The scope is limited to the affected Db2 instance, but unauthorized command execution could facilitate further lateral movement within the database environment (IBM Advisory, Feedly).

IBM has released patches for affected versions; organizations should contact IBM support for version-specific fixes covering Db2 11.5.x (up to 11.5.9) and 12.1.x (up to 12.1.3) branches, with patch details available at the IBM support page. As an interim workaround, administrators should review and audit remote storage alias configurations, applying the principle of least privilege, and consider temporarily disabling cataloged remote storage aliases if patching cannot be performed immediately. Monitoring for authenticated users performing actions beyond their authorized scope is also recommended (IBM Advisory).