CVE-2025-36372: IBM Db2 Information Disclosure in Monitoring Tables

Technical summary

The vulnerability stems from insufficient access controls on Db2's monitoring and event tables (CWE-538: Information Exposure Through Query Strings in GET Request). When a user authenticates to Db2, the database fails to properly restrict their visibility into these internal monitoring structures, permitting disclosure of sensitive operational and diagnostic data that should be gated behind higher privilege levels or administrative roles. The issue is local to the Db2 instance and requires prior authentication, limiting the attack surface to credentialed actors.

Business impact

Organizations relying on Db2 for sensitive workloads face potential exposure of operational intelligence, performance metrics, and diagnostic information that could reveal system configuration, user activity patterns, or other confidential details. For enterprises using Db2 Connect Server to manage distributed database connections, the risk extends across multiple client environments. While the vulnerability does not enable data modification or service disruption, the confidentiality breach can inform further reconnaissance or supply competitive intelligence if sensitive schema or usage patterns are disclosed.

Affected systems

The vulnerability affects IBM Db2 on Linux, UNIX, and Windows operating systems across two major version lines: all patch levels from 11.5.0 through 11.5.9, and all patch levels from 12.1.0 through 12.1.4. Db2 Connect Server, used for client-server database connections, is explicitly included. Organizations running Db2 11.5 (end-of-support) or 12.1 (current mainstream support) should inventory their deployments and determine which fall within these ranges.

Exploitability

Exploitation requires an authenticated Db2 user account—an attacker cannot abuse this remotely or without valid credentials. The attack is straightforward once authenticated: querying or accessing the monitoring tables to retrieve restricted information. No user interaction is required, and the vulnerability is locally accessible on the database host. The CVSS score of 5.5 (Medium) reflects low attack complexity and the requirement for legitimate database access, balanced against high confidentiality impact and no integrity or availability consequences.

Remediation

IBM has released patches addressing this vulnerability. Organizations must upgrade Db2 11.5 instances to version 11.5.9 or later (or migrate to a supported version), and upgrade Db2 12.1 instances to version 12.1.4 or later. For those running unsupported versions (11.5 is approaching end-of-life), upgrading to Db2 12 or later versions (beyond 12.1.4) is recommended. After patching, validate that monitoring table access controls are properly enforced through functional testing.

Patch guidance

Verify the exact patch availability against IBM's official security bulletin and Db2 support portal for your platform (Linux, Unix, or Windows). For production environments, plan patching during scheduled maintenance windows, as Db2 instance restarts may be required. Test patches in a staging environment first to confirm compatibility with existing applications and configurations. If running Db2 Connect Server, ensure all client and server components are updated together. Document your baseline version before and after patching for compliance records.

Detection guidance

Monitor Db2 audit logs and access logs for authenticated users querying system monitoring or event tables (such as MON_* or related system catalog views). Implement database activity monitoring (DAM) tools to alert on unusual access patterns to sensitive internal tables. Review current user privilege assignments and restrict monitoring table access to administrative accounts only, using role-based access control. Query Db2's system catalog to identify which users currently have permissions on these tables and revoke unnecessary grants.

Why prioritize this

This vulnerability merits prompt but measured attention. Its Medium severity and requirement for authenticated access mean it is not an immediate showstopper, but the confidentiality exposure could reveal operational secrets valuable to threat actors during reconnaissance. Prioritize patching for Db2 instances that store or process sensitive data (financial, healthcare, PII), or that are exposed to users outside your organization (cloud-hosted, SaaS). For internal development or non-sensitive workloads, this can follow standard change management, but should not be deferred beyond the next quarterly patch cycle.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a Medium severity: high confidentiality impact (C:H) because authenticated users can read sensitive information, but no impact on integrity (I:N) or availability (A:N). The attack vector is local (AV:L), meaning the attacker must have access to the Db2 instance, and access requires privileges (PR:L—low privilege account), narrowing the threat group. Attack complexity is low (AC:L), as no special circumstances are needed to trigger the exposure. The score does not account for business context; adjust your internal risk rating upward if the affected Db2 instance contains highly sensitive data or if insider risk is a concern.

Frequently asked questions