CVE-2025-36117: IBM Db2 Mirror for i Auth Bypass Vulnerability

CVE-2025-36117 Overview

CVE-2025-36117 is a session management vulnerability in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. The product fails to invalidate session identifiers after use, allowing an authenticated user to reuse a prior session token and impersonate another user on the system. The weakness maps to [CWE-384: Session Fixation]. IBM has published a support advisory for affected customers.

Critical Impact
An authenticated attacker can hijack a valid session identifier that was not invalidated after logout or termination, impersonating a different user and gaining access to data and operations tied to that identity.

Affected Products

IBM Db2 Mirror for i 7.4
IBM Db2 Mirror for i 7.5
IBM Db2 Mirror for i 7.6

Discovery Timeline

2025-07-23 - CVE-2025-36117 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36117

Vulnerability Analysis

IBM Db2 Mirror for i provides continuous availability through active-active database replication on IBM i systems. The administrative interface relies on session identifiers to maintain authenticated state. The affected versions do not disallow a session identifier after its intended lifecycle ends, leaving the token valid for reuse.

An authenticated attacker who captures or recovers a session identifier belonging to another user can submit it in subsequent requests. The server accepts the stale identifier and binds the request to the original user context, enabling full impersonation within the privileges of that account.

The weakness is classified as [CWE-384] Session Fixation. Exploitation requires network access to the Db2 Mirror for i management interface and valid low-privilege credentials, but no user interaction.

Root Cause

The root cause is improper session lifecycle management. The application does not invalidate session identifiers after logout, timeout, or privilege change. Without server-side revocation, a token remains a bearer credential long after its intended use, violating the principle that session identifiers must become unusable once a session ends.

Attack Vector

Attack delivery occurs over the network against the Db2 Mirror for i interface. An attacker with valid low-privilege credentials captures a session identifier through logs, shared systems, proxy history, or disclosure channels. The attacker then replays the identifier in HTTP requests. Because the server does not reject the stale token, the attacker executes actions as the impersonated user. No end-user interaction is required.

No public proof-of-concept exploit code has been published for CVE-2025-36117. Refer to the IBM Support Page for vendor-provided technical details.

Detection Methods for CVE-2025-36117

Indicators of Compromise

Repeated use of the same session identifier across different source IP addresses or user agents within a short interval.
Session identifiers appearing in authenticated requests after the associated user has logged out or the session should have expired.
Audit log entries showing actions attributed to a user who was not actively signed in at the recorded time.

Detection Strategies

Correlate authentication logs with session activity to identify tokens that remain active past logout events.
Flag concurrent sessions bound to the same identifier originating from distinct network locations.
Baseline normal session durations for administrative accounts and alert on tokens surviving beyond expected windows.

Monitoring Recommendations

Forward IBM i audit journals and Db2 Mirror interface logs to a centralized analytics platform for session correlation.
Monitor administrative actions executed by privileged accounts and alert on anomalies tied to session reuse.
Review network captures of the management interface for identifier replay patterns across sessions.

How to Mitigate CVE-2025-36117

Immediate Actions Required

Apply the fixes referenced in the IBM Support Page for CVE-2025-36117 across all Db2 Mirror for i 7.4, 7.5, and 7.6 installations.
Rotate credentials for accounts that use the Db2 Mirror for i interface and terminate active sessions after patching.
Restrict network reachability of the Db2 Mirror management interface to administrative networks only.

Patch Information

IBM has published remediation guidance for CVE-2025-36117 at the IBM Support Page. Administrators should follow the IBM-provided PTF (Program Temporary Fix) instructions for each affected release of Db2 Mirror for i.

Workarounds

Enforce short session timeouts on the management interface to limit the window during which a stale identifier remains valid.
Require users to re-authenticate before performing privileged operations.
Isolate the Db2 Mirror for i management interface behind a VPN or bastion host, limiting exposure to authenticated internal users.

bash

# Configuration example
# Restrict access to the Db2 Mirror for i management interface using host firewall rules
# Replace <mgmt-port> and <admin-subnet> with values from your environment
iptables -A INPUT -p tcp --dport <mgmt-port> -s <admin-subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport <mgmt-port> -j DROP