IBM Db2 EUVD-2025-210373

Exploitation requires a low-privilege authenticated Db2 user session with local system access (AV:L, PR:L per CVSS vector). The attacker must be able to execute SQL queries against the Db2 monitoring and event tables - this access is the direct prerequisite. Internet-facing or unauthenticated exploitation is not possible given the local attack vector. Exploitation is further limited to Db2 instances where low-privilege users have been granted any query access to monitoring table namespaces; deployments where such access is already restricted to administrative roles would not be exploitable. No non-default configuration setting or specific feature flag is described as required beyond the default state of monitoring and event table visibility.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N yields a Medium score of 5.5, which accurately captures the constrained but non-trivial nature of this flaw. The local attack vector (AV:L) is the primary risk limiter - network-based unauthenticated exploitation is ruled out, confining the threat to actors who already possess host-level or database-level access. Low complexity (AC:L) and no user interaction (UI:N) mean that once access is established, exploitation is trivial with no additional setup. The high confidentiality impact (C:H) reflects that monitoring and event tables may contain operationally sensitive data, though the actual sensitivity depends on what Db2 captures in those tables for a given deployment. No EPSS score was included in available intelligence, and the absence of KEV listing and public POC means this is not currently being actively exploited at scale. Real-world priority is moderate: elevated for organizations with shared Db2 environments, multi-tenant deployments, or strict data segregation requirements; lower for single-tenant installations where all Db2 users are already trusted administrators.

An attacker who has obtained a low-privilege Db2 user credential - via phishing, credential reuse, or a prior compromise of the host - authenticates locally to the Db2 instance and issues SELECT queries against monitoring and event tables. These tables may surface sensitive operational data such as SQL query history, connection strings, or configuration parameters not intended for that user's access level. No public POC has been identified, but the attack requires no special tooling beyond standard SQL client access.