IBM Db2
CVE-2025-36186
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privileged account
-
DeliveryIdentify over-privileged Db2 component in vulnerable config
-
ExploitSupply malicious code to that component
-
ExecutionCode executes at elevated privilege
-
ImpactEscalate to root/SYSTEM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V8 - Authorization Unnecessary privilege execution
|
| Exploitation Conditions | Exploitation requires (1) prior local access to the Db2 host with an existing low-privileged account (PR:L, AV:L - not remotely reachable), and (2) a vulnerable Db2 12.1.0-12.1.3 LUW / Db2 Connect Server instance running under the 'specific configurations' noted by IBM in which a Db2 component executes with higher-than-minimum (CWE-250) privileges. The precise configuration is not named in the available data and must be confirmed against IBM advisory node 7250486; installations not in that configuration are not exploitable. No user interaction is required (UI:N). The requirement for local authenticated access and a non-universal configuration are the primary factors limiting real-world risk despite the full-root impact. |
| Impact | This is a genuine but moderate-priority local privilege escalation. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) confirms the attacker must already have local access and a low-privilege account (PR:L), so this is a post-compromise escalation to root rather than an initial-access or remotely-triggerable flaw. All exploitation signals point to low real-world urgency: EPSS is 0.03% (7th percentile), there is no CISA KEV listing (not confirmed actively exploited), and no public exploit code was identified in the provided data. CWE-250 (Execution with Unnecessary Privileges) combined with the description's 'under specific configurations' language indicates the flaw is not reachable in every deployment, further narrowing exposure. No SSVC decision data was supplied. The signals are internally consistent - high technical impact (full root) but low exploitation probability and an access barrier (local, authenticated) - so this belongs in routine patch cycles for Db2 hosts where untrusted local users exist, not in emergency response. The main caveat: the description says 'specific configurations' without naming them, so defenders cannot precisely scope affected installs from the provided data alone. |
| Exploit ScenarioDerived | A local user with an existing low-privilege account on a Linux/UNIX/Windows host running a vulnerable, specifically-configured Db2 12.1.x instance abuses a Db2 component that runs with higher-than-necessary privileges to execute attacker-controlled code, gaining root/SYSTEM. No public exploit code was identified at time of analysis, and the attack requires prior local access plus the specific configuration to be present. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 07, 2026
Local privilege escalation to root in IBM Db2 12.1.0 through 12.1.3 for Linux, UNIX and Windows (including Db2 Connect Server) allows an attacker who already holds a low-privileged local account on the database host to execute malicious code that elevates them to root, because a Db2 component is configured to run with higher-than-minimum privileges (CWE-250, execution with unnecessary privileges). Exploitation requires both prior local access (AV:L, PR:L, UI:N) and a Db2 instance running in one of the specific configurations IBM calls out in advisory node 7250486, so default or unrelated configurations are not affected. This is a genuine but moderate-priority local privilege escalation rather than a broadly reachable flaw: CVSS 3.1 base score is 7.8 with high confidentiality, integrity and availability impact, EPSS is only about 0.03% (7th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
Earlier versions of this analysis (1)
IBM Db2 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) under specific configurations could allow a local user to execute malicious code that escalate their privileges. Rated high severity (CVSS 7.4), this vulnerability is no authentication required. No vendor patch available.
RemediationAI
IBM's remediation guidance for this issue is published in the vendor advisory at https://www.ibm.com/support/pages/node/7250486, which should be consulted to confirm whether a given 12.1.0-12.1.3 installation is in the vulnerable configuration and to obtain the exact fixed 12.1.x level; the available intelligence does not state a specific fix-pack number, so the fix version must be taken directly from that advisory rather than assumed. Until the applicable vendor fix is applied, treat the issue with targeted compensating controls: audit the Db2 host for Db2 binaries, helpers and startup scripts that carry setuid/setgid bits or are launched with elevated privileges and remove unnecessary privilege grants so components run at the lowest level that still supports operation (trade-off: this can break features such as fenced routines or instance-owner operations and must be staged and tested); tighten local access so that DB2 instance and OS accounts are strictly limited to users who require them and remove users from privileged groups such as db2iadm1, db2fadm1 or the instance owner group (trade-off: reduces operational flexibility for DBAs but directly removes the PR:L foothold the exploit needs); and enable OS-level auditing and monitoring for privilege-escalation behavior in Db2-related processes on affected hosts. These are mitigations, not substitutes for the vendor fix, and they only reduce exposure for hosts that cannot yet be patched.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-250, Execution with Unnecessary Privileges: a Db2 process or helper is permitted to run at a privilege level above the minimum required for its function, which gives a local user with an existing low-privileged Db2 or host account a path to leverage that over-privileged execution context into root code execution. The affected technology stack is IBM Db2 12.1.x for Linux, UNIX and Windows (LUW), including the bundled Db2 Connect Server component; CPE data pins the exposure to cpe:2.3:a:ibm:db2 running on linux, unix and windows platforms. The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms the attacker must already be present on the host with low privileges, needs no user interaction, and that success yields full compromise of confidentiality, integrity and availability of the Db2 host; the scope is unchanged, so the impact is confined to the vulnerable component's security authority (in practice root on the host). Notably, the flaw is not remotely triggerable and requires a non-universal configuration, which is the primary constraint on real-world exploitability; the exact configuration condition is not enumerated in the available intelligence and must be confirmed against IBM support document node 7250486 before assuming a given deployment is at risk.
Know when Db2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated user needed (AV:L, PR:L); an over-privileged component yields full root, giving C:H/I:H/A:H; scope unchanged as escalation stays on the same host.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM Db2 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) under specific configurations could allow a local user to execute malicious code that escalate their privileges to root due to execution of unnecessary privileges operated at a higher than minimum level.
Executive ViewAI
IBM Db2 versions 12.1.0 through 12.1.3 (including Db2 Connect Server) on Linux, UNIX, and Windows contain a local privilege escalation flaw that allows someone who already holds a low-privileged account on a database host to gain root-level control of that server. Because the vulnerable component runs with more privilege than necessary, a compromised or careless local account could become a full system compromise, putting the confidentiality, integrity, and availability of data hosted on that Db2 instance at risk. The exposure is real but narrow - it demands pre-existing local access plus a specific Db2 configuration, and no public exploit code or active exploitation has been identified - so leadership should treat this as a targeted hardening and patch-tracking priority rather than an emergency.
No vendor-released patch identified at time of analysis. Interim mitigations: confirm whether any instance matches the specific configurations in IBM advisory node 7250486 and change or disable those settings where feasible; enforce least privilege on the Db2 component identified as running with unnecessary privileges; reduce and tightly control local accounts and interactive shell access on Db2 hosts; monitor database hosts for local privilege-escalation activity and alert on anomalies; and request an interim fix or fixed build directly from IBM support.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Affected Products (CPE)NVD
Stack-based buffer overflow in the SQL/PSM (aka SQL Persistent Stored Module) Stored Procedure (SP) infrastructure in IB
IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a stack-bas
Stack-based buffer overflow in IBM DB2 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on Linux
IBM DB2 9.5 uses world-writable permissions for nodes.reg, which has unspecified impact and attack vectors. Rated critic
Remote code execution in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 lets unauthenticated network attackers run arbitrary co
Privilege escalation in IBM Db2 (data server versions 11.5.0-11.5.9 and 12.1.0-12.1.5) allows an attacker to submit a sp
Memory-corruption in IBM Db2's IXF file IMPORT parser lets an attacker supply a crafted IXF data file that overflows a s
Stack-based buffer overflow in the Java Stored Procedure infrastructure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7
Directory traversal vulnerability in the UTL_FILE module in IBM DB2 and DB2 Connect 10.1 before FP1 on Windows allows re
IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system
Integer signedness error in the db2dasrrm process in the DB2 Administration Server (DAS) in IBM DB2 9.1 through FP11, 9.
The Stored Procedure infrastructure in IBM DB2 9.5, 9.7 before FP9a, 10.1 before FP3a, and 10.5 before FP3a on Windows a
GitHub PoC
Exploit-DB