CVE-2025-36365

🗓️ 30 Jan 2026 21:27:54Reported by ibmType

CVE-2025-36365 IBM Db2 privilege escalation allows authenticated users to run unauthorized commands via remote storage aliases with a user key.

Reporter	Title	Published	Views	Family All 16
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities have been identified in IBM DB2 shipped with IBM WebSphere Remote Server	10 Feb 202603:19	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilities in IBM DB2 bundled with IBM Application Performance Management products.	17 Feb 202613:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Db2® is vulnerable to privilege escalation under specific configuration of cataloged remote storage aliases (CVE-2025-36365)	30 Jan 202614:14	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM® Db2® affect IBM® Db2® Big SQL on IBM Cloud Pak for Data.	15 May 202614:46	–	ibm
ATTACKERKB	CVE-2025-36365	30 Jan 202621:27	–	attackerkb
Circl	CVE-2025-36365	19 Mar 202600:00	–	circl
CNNVD	IBM Db2 security vulnerabilities	30 Jan 202600:00	–	cnnvd
Cvelist	CVE-2025-36365 IBM Db2 Privilege Escalation	30 Jan 202621:27	–	cvelist
EUVD	EUVD-2025-206558	31 Jan 202600:30	–	euvd
NVD	CVE-2025-36365	30 Jan 202622:15	–	nvd

NVD

Vulners

Node

ibm db2Range11.5.0–11.5.9linux

ibm db2Range11.5.0–11.5.9unix

ibm db2Range11.5.0–11.5.9windows

ibm db2Range12.1.0–12.1.3linux

ibm db2Range12.1.0–12.1.3unix

ibm db2Range12.1.0–12.1.3windows

[
  {
    "cpes": [
      "cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:linux:*:*",
      "cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:unix:*:*",
      "cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:aix:*:*",
      "cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:windows:*:*",
      "cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:zos:*:*",
      "cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:linux:*:*",
      "cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:unix:*:*",
      "cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:aix:*:*",
      "cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:windows:*:*",
      "cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:zos:*:*",
      "cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:linux:*:*",
      "cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:unix:*:*",
      "cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:aix:*:*",
      "cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:windows:*:*",
      "cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:zos:*:*",
      "cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:linux:*:*",
      "cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:unix:*:*",
      "cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:aix:*:*",
      "cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:windows:*:*",
      "cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:zos:*:*"
    ],
    "defaultStatus": "unaffected",
    "product": "Db2 for Linux, UNIX and Windows",
    "vendor": "IBM",
    "versions": [
      {
        "lessThanOrEqual": "11.5.9",
        "status": "affected",
        "version": "11.5.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "12.1.3",
        "status": "affected",
        "version": "12.1.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
ibm	www.ibm.com/support/pages/node/7257665

05 Feb 2026 19:57Current

6Medium risk

Vulners AI Score6

CVSS 3.16.8 - 7.5

EPSS0.00016

SSVC

CWE-639