What is the CVSS score of CVE-2025-13755?

CVE-2025-13755 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2025-13755?

Yes, a patch is available for CVE-2025-13755. Update the affected software to the latest version immediately.

IBM Db2 CVE-2025-13755

EUVD-2025-209933 MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2026-05-26 ibm

GHSA-vhw4-7vwf-ww45

Information Disclosure Microsoft IBM Db2

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 12:25 vuln.today

CVE Published

May 26, 2026 - 15:46 nvd

MEDIUM 5.5

DescriptionCVE.org

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes DB2 Connect Server) stores potentially sensitive information in log files that could be read by a local user.

AnalysisAI

IBM Db2 on Linux, UNIX, and Windows - versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4, including DB2 Connect Server - writes potentially sensitive information into log files readable by local OS users, creating an insider-threat-class confidentiality exposure. The CVSS confidentiality impact is rated High (C:H), but the attack is strictly local (AV:L) and requires only a standard low-privilege OS account (PR:L), making this a post-access or insider-threat scenario rather than an internet-facing risk. No public exploit has been identified at time of analysis, EPSS sits at the 2nd percentile (0.01%), and CISA SSVC records no active exploitation - IBM has released a patch addressed in advisory https://www.ibm.com/support/pages/node/7273554.

Technical ContextAI

IBM Db2 is a widely deployed enterprise relational database management system spanning Linux, UNIX, and Windows. The root cause is CWE-532 (Insertion of Sensitive Information into Log File), a class of vulnerability where the application writes data - such as SQL query content, credentials, or internal configuration state - to diagnostic or operational log files without adequately filtering or redacting sensitive tokens. The affected CPE is cpe:2.3:a:ibm:db2:*:*:*:*:*:*:*:* covering the two named version streams. Because OS log directories on these platforms may be accessible to any authenticated local user depending on file permission configuration, the database's logging subsystem becomes an unintended data disclosure channel. DB2 Connect Server, which acts as a gateway for distributed database access, is explicitly included in the scope, potentially broadening the classes of sensitive transit data captured in logs.

RemediationAI

IBM has confirmed a patch is available; apply the fix described in the vendor advisory at https://www.ibm.com/support/pages/node/7273554 - the exact patched version number must be confirmed directly from that advisory, as NVD CPE data does not specify a fixed release version. While awaiting patching, restrict OS-level read permissions on the Db2 diagnostic log directory (typically defined by the DIAGPATH database manager configuration parameter) to the db2 service account and the DBA administrative group exclusively, preventing general local OS users from browsing log content - note this change may impair operations-team log access for troubleshooting. Additionally, lower the Db2 diagnostic logging verbosity level (DIAGLEVEL) to reduce the volume of potentially sensitive operational data captured in logs, though reducing DIAGLEVEL may degrade incident response fidelity. Audit existing log files for sensitive content and securely archive or purge logs written under the vulnerable versions before applying the patch.