CVE-2025-36371: IBM i Database Plan Cache Information Disclosure

CVE-2025-36371 Overview

CVE-2025-36371 is an information disclosure vulnerability in the IBM i database plan cache implementation. IBM i versions 7.2, 7.3, 7.4, 7.5, and 7.6 are affected. A user with access to the database plan cache can view information they are not authorized to see. The weakness is categorized under [CWE-598], which covers use of GET request with sensitive query strings and analogous exposure patterns through accessible caches. IBM has published a support advisory addressing the flaw. Exploitation requires low-privilege network access with no user interaction, and the flaw impacts confidentiality only.

Critical Impact
Authenticated users with plan cache access can retrieve query metadata and data references belonging to other users, exposing sensitive database contents across tenants and application boundaries.

Affected Products

IBM i 7.2
IBM i 7.3
IBM i 7.4
IBM i 7.5 and 7.6

Discovery Timeline

2025-11-19 - CVE-2025-36371 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36371

Vulnerability Analysis

The IBM i database plan cache stores execution plans generated by the SQL query optimizer. These plans include metadata about the tables, columns, host variables, and literal values referenced by prior queries. On IBM i, low-privileged users who can access the plan cache can inspect entries created by other users. This exposes query fragments, object names, and cached parameter values that the requesting account has no direct authority to read.

The vulnerability is remotely reachable through standard IBM i database interfaces such as Db2 for i services, ODBC, JDBC, and CL commands that surface plan cache contents. Because the plan cache is a shared, system-wide resource, a single authenticated session is sufficient to enumerate sensitive information across the partition.

Root Cause

The root cause is missing authorization enforcement on plan cache read paths. Plan cache entries retain references to protected schemas and literal values, but the implementation does not filter results based on the requester's object-level authority. The design assumes plan cache visibility is administratively restricted, which is not consistently enforced across all supported access methods.

Attack Vector

An attacker authenticates to the target IBM i partition with any valid user profile that has access to plan cache interfaces. The attacker then queries plan cache tables, snapshots, or services such as QSYS2.DUMP_PLAN_CACHE_TOPN and related views. Returned rows disclose SQL text, referenced object names, and literal parameter values from other users' sessions. No user interaction, elevated privileges, or code execution is required.

No public proof-of-concept exploit or exploit database entry is listed for CVE-2025-36371, and CISA has not added it to the Known Exploited Vulnerabilities (KEV) catalog.

Detection Methods for CVE-2025-36371

Indicators of Compromise

Unexpected queries against QSYS2 plan cache views or the DUMP_PLAN_CACHE_* service functions originating from non-administrative user profiles.
Recurring ODBC or JDBC sessions issuing plan cache reads outside of documented DBA workflows.
Application accounts accessing SQL plan snapshot files stored in /tmp or user-defined IFS directories.

Detection Strategies

Audit IBM i journal receivers for QIBM_DB_SQL and QAUDJRN entries tied to plan cache service invocations.
Correlate authenticated database sessions with the user profiles authorized to perform database performance analysis, and alert on deviations.
Baseline normal plan cache access patterns and flag statistical anomalies in volume, source IP, or time of day.

Monitoring Recommendations

Forward IBM i audit journal and Db2 for i telemetry to a centralized analytics platform for retention and query.
Track use of QSYS2.DUMP_PLAN_CACHE_TOPN, QSYS2.DUMP_PLAN_CACHE_properties, and equivalent services per user profile.
Alert on plan cache reads by service accounts that historically execute only application SQL.

How to Mitigate CVE-2025-36371

Immediate Actions Required

Apply the IBM PTFs referenced in the vendor advisory for IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 as soon as change control permits.
Inventory user profiles with *USE authority to plan cache services and revoke access from accounts that do not require it.
Restrict network access to Db2 for i host servers to trusted management segments only.

Patch Information

IBM has released fixes documented on the IBM Support Page for CVE-2025-36371. Administrators should identify the appropriate Group PTF level for each supported IBM i release and apply it through standard PTF management procedures. Verify installation with DSPPTF after the update.

Workarounds

Limit authority on plan cache service functions and views to a small group of database administrators.
Disable or restrict unused host server interfaces that expose Db2 for i to general user populations.
Rotate any database credentials or literal secrets that may have been exposed through prior plan cache retention.

bash

# Example: restrict access to a plan cache service function on IBM i
RVKOBJAUT OBJ(QSYS2/DUMP_PLAN_CACHE_TOPN) OBJTYPE(*SRVPGM) USER(*PUBLIC) AUT(*ALL)
GRTOBJAUT OBJ(QSYS2/DUMP_PLAN_CACHE_TOPN) OBJTYPE(*SRVPGM) USER(DBADMIN) AUT(*USE)

# Verify installed PTFs after applying the IBM fix
DSPPTF LICPGM(5770SS1)