CVE-2025-36365: IBM Db2 Authorization Bypass Vulnerability

CVE-2025-36365 Overview

CVE-2025-36365 is an authorization bypass vulnerability in IBM Db2 for Linux, UNIX and Windows, including Db2 Connect Server. The flaw affects versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3. Under specific configurations involving cataloged remote storage aliases, an authenticated user can execute unauthorized commands by manipulating a user-controlled key. The vulnerability is classified under [CWE-639] (Authorization Bypass Through User-Controlled Key) and carries a CVSS score of 7.5.

Critical Impact
Authenticated attackers can bypass authorization checks against cataloged remote storage aliases to execute unauthorized commands, compromising data confidentiality, integrity, and availability.

Affected Products

IBM Db2 for Linux, UNIX and Windows 11.5.0 through 11.5.9
IBM Db2 for Linux, UNIX and Windows 12.1.0 through 12.1.3
IBM Db2 Connect Server (same version ranges)

Discovery Timeline

2026-01-30 - CVE-2025-36365 published to NVD
2026-02-05 - Last updated in NVD database

Technical Details for CVE-2025-36365

Vulnerability Analysis

The vulnerability resides in how IBM Db2 validates access to cataloged remote storage aliases. Remote storage aliases provide named references to external storage endpoints used during operations such as backup, restore, and data ingestion. When a specific configuration is in place, Db2 relies on a user-supplied identifier to resolve the storage alias without sufficiently verifying that the authenticated session has authorization for the target resource.

Because the access decision is bound to a user-controlled key, an authenticated database user can substitute identifiers that reference aliases beyond their privilege scope. The result is execution of commands the user is not entitled to run against those storage targets. The CWE-639 classification reflects this dependence on attacker-influenced input for authorization decisions rather than on a server-side enforced policy.

Root Cause

The root cause is improper authorization enforcement on cataloged remote storage aliases. Db2 trusts a client-supplied key during alias resolution and command dispatch instead of independently validating the caller against the alias owner and grants. This pattern allows horizontal and vertical privilege movement across alias-bound operations.

Attack Vector

Exploitation requires network access to the database instance and valid low-privilege credentials. The attacker submits commands referencing remote storage aliases while supplying a key that maps to an alias outside their authorized set. No user interaction is required, but the attack complexity is high because the environment must have remote storage aliases cataloged in the vulnerable configuration. Refer to the IBM Support Page for configuration-specific details.

Detection Methods for CVE-2025-36365

Indicators of Compromise

Db2 audit log entries showing commands referencing remote storage aliases executed by accounts without explicit grants on those aliases.
Backup, restore, or ingest operations targeting storage aliases inconsistent with the user's normal activity profile.
Unexpected outbound connections from the Db2 server to remote object storage endpoints associated with cataloged aliases.

Detection Strategies

Enable Db2 audit facility (db2audit) with the EXECUTE and OBJMAINT categories to capture alias-bound command execution and catalog modifications.
Correlate authenticated session identifiers with the alias keys used in each command to flag mismatches between user grants and accessed aliases.
Baseline normal use of CATALOG STORAGE ACCESS aliases per role and alert on deviations.

Monitoring Recommendations

Forward Db2 diagnostic logs (db2diag.log) and audit archives to a centralized SIEM for retention and correlation.
Monitor changes to the storage alias catalog (SYSCAT.STORAGEALIAS) for additions or modifications outside change-control windows.
Track network egress from database hosts to object storage endpoints and reconcile against authorized backup or restore jobs.

How to Mitigate CVE-2025-36365

Immediate Actions Required

Apply the IBM security update referenced on the IBM Support Page to all affected Db2 instances in 11.5.0–11.5.9 and 12.1.0–12.1.3.
Inventory cataloged remote storage aliases using LIST STORAGE ACCESS and review which users and roles can reference them.
Revoke unnecessary privileges from low-trust accounts that do not require remote storage operations.

Patch Information

IBM has published fix information through its official advisory. Administrators should review the IBM Support Page for the specific fix pack levels and platform-specific installation guidance covering Db2 for Linux, UNIX and Windows and Db2 Connect Server.

Workarounds

Uncatalog remote storage aliases that are not actively required for production workloads using UNCATALOG STORAGE ACCESS.
Restrict the configuration conditions described in the IBM advisory until patching is complete, including removing exposure of aliases to broadly granted roles such as PUBLIC.
Enforce least privilege so that only dedicated backup or administrative principals can reference storage aliases.

bash

# Configuration example: inventory and tighten storage alias exposure
db2 "LIST STORAGE ACCESS"
db2 "REVOKE USAGE ON STORAGE ACCESS <alias_name> FROM PUBLIC"
db2 "UNCATALOG STORAGE ACCESS <unused_alias>"
db2audit configure scope execute,objmaint status both
db2audit start