CVE-2025-36372: 
IBM Db2 vulnerability analysis and mitigation

CVE-2025-36372 is an information disclosure vulnerability in IBM Db2 that allows authenticated users to access sensitive information from monitoring and event tables. It affects IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 for Linux, UNIX, and Windows, including Db2 Connect Server. The vulnerability was published on June 30, 2026, with IBM's advisory released on the same date. It carries a CVSS v3.1 base score of 6.5 (Medium) per NVD, or 5.5 (Moderate) per the GitHub Advisory Database (IBM Advisory, GitHub Advisory).

The root cause is classified as CWE-538 (Insertion of Sensitive Information into Externally-Accessible File or Directory), meaning Db2 places sensitive data into monitoring and event tables that are accessible to authenticated users who should not have visibility into that information. The attack vector is network-based with low attack complexity and requires only low-level privileges — no user interaction is needed. An authenticated user can query the monitoring or event tables to retrieve sensitive information that exceeds their intended access scope (IBM Advisory, GitHub Advisory).

Successful exploitation results in a high confidentiality impact with no effect on integrity or availability. An authenticated low-privileged user could access sensitive information stored in Db2 monitoring and event tables, potentially exposing database internals, query data, connection details, or other operational metadata that could facilitate further attacks or privilege escalation. The scope is limited to the affected Db2 instance, with no direct lateral movement capability inherent to this vulnerability (IBM Advisory, GitHub Advisory).

IBM has released patches addressing this vulnerability. Users should upgrade IBM Db2 to a fixed version beyond 11.5.9 (for the 11.5.x branch) or beyond 12.1.4 (for the 12.1.x branch) as directed by IBM's security bulletin. Organizations should review access controls on Db2 monitoring and event tables to restrict access to only authorized administrative users as an interim measure. Refer to the IBM support page for specific fix pack details and installation instructions (IBM Advisory).

Coverage of this vulnerability has been limited, with Heise Online reporting on IBM Db2 security updates in the context of a broader set of Db2 vulnerabilities disclosed around the same time. No significant independent researcher commentary or notable community discussion specific to CVE-2025-36372 has been identified beyond standard vulnerability aggregator coverage.