CVE-2025-36372: IBM Db2 Information Disclosure Flaw

CVE-2025-36372 Overview

CVE-2025-36372 is an information disclosure vulnerability affecting IBM Db2 for Linux, UNIX, and Windows, including Db2 Connect Server. The flaw exists in versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4. An authenticated user can read sensitive information from monitoring and event tables that should be restricted. The issue is tracked under [CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory].

Critical Impact
Authenticated database users can retrieve sensitive data from Db2 monitoring and event tables, exposing information that may include query text, session details, and other operational metadata.

Affected Products

IBM Db2 for Linux, UNIX, and Windows versions 11.5.0 through 11.5.9
IBM Db2 for Linux, UNIX, and Windows versions 12.1.0 through 12.1.4
IBM Db2 Connect Server (bundled with affected Db2 releases)

Discovery Timeline

2026-06-30 - CVE-2025-36372 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2025-36372

Vulnerability Analysis

CVE-2025-36372 is an information disclosure issue in the monitoring and event subsystems of IBM Db2. Db2 exposes monitoring interfaces through administrative views, table functions, and event monitor tables that capture runtime activity such as statement text, package cache entries, connection details, and workload metrics. Under normal conditions, access to this telemetry is restricted to users holding privileges such as SYSMON, DBADM, or equivalent monitoring authorities.

The vulnerability allows a low-privileged authenticated user to obtain data from these monitoring and event tables without holding the required authority. Because monitoring tables can contain the text of SQL statements and parameter values submitted by other sessions, an attacker can harvest data belonging to other users of the database, including query fragments that may reveal sensitive business data.

Root Cause

The root cause is improper access enforcement on specific monitoring and event tables within Db2. Authorization checks that should gate access to these interfaces do not consistently apply, allowing a session that lacks monitoring privileges to read rows it should not see. IBM classifies the flaw under [CWE-538], reflecting insertion of sensitive information into a location that is reachable by users who should not have access.

Attack Vector

Exploitation requires network access to the Db2 instance and valid authentication credentials, but no user interaction. An attacker who obtains any authenticated database account can query the affected monitoring and event tables directly through standard Db2 client interfaces. No memory corruption, injection, or code execution primitive is required. The attacker simply issues SQL against the exposed objects and receives data that policy should have blocked.

The vulnerability does not permit modification or destruction of data, and it does not affect availability. Impact is limited to confidentiality of information stored in Db2's operational telemetry.

Detection Methods for CVE-2025-36372

Indicators of Compromise

Unexpected queries from low-privileged accounts against Db2 monitoring table functions such as MON_GET_ACTIVITY, MON_GET_PKG_CACHE_STMT, or event monitor tables.
Repeated SELECT statements referencing SYSIBMADM monitoring views by users without SYSMON or DBADM authority.
Audit records showing successful reads of event monitor target tables by accounts that do not administer them.

Detection Strategies

Enable Db2 audit facility policies that record EXECUTE and OBJMAINT events on monitoring views, table functions, and event monitor tables.
Baseline which accounts legitimately query monitoring interfaces and alert on any deviation from that list.
Correlate database audit logs with authentication logs to identify credentials that begin exercising monitoring interfaces for the first time.

Monitoring Recommendations

Forward Db2 audit output to a centralized SIEM or data lake for retention and analysis.
Alert on high-volume reads against MON_GET_* table functions from application service accounts that should not require monitoring data.
Review event monitor target table permissions periodically and confirm they match the least-privilege model documented for the environment.

How to Mitigate CVE-2025-36372

Immediate Actions Required

Inventory all Db2 for LUW instances and identify installations running versions 11.5.0 through 11.5.9 or 12.1.0 through 12.1.4.
Apply the fix pack referenced in the IBM Support Document as soon as change windows allow.
Rotate credentials for any accounts suspected of misuse and audit recent access to monitoring and event tables.

Patch Information

IBM has published remediation guidance in the IBM Support Document for CVE-2025-36372. Administrators should upgrade to the fixed Db2 level identified by IBM for the affected 11.5 and 12.1 branches. The advisory contains specific fix pack levels and interim fix identifiers for each supported platform, including Linux, UNIX, and Windows deployments of Db2 and Db2 Connect Server.

Workarounds

Revoke unnecessary grants on monitoring table functions and event monitor tables from PUBLIC and from roles that do not require monitoring data.
Restrict CONNECT authority on affected databases to accounts that have a documented business need until the patch is deployed.
Enable and review the Db2 audit facility to detect access attempts against monitoring interfaces during the mitigation window.

bash

# Example: revoke broad access to monitoring interfaces until patched
db2 "REVOKE EXECUTE ON FUNCTION SYSPROC.MON_GET_PKG_CACHE_STMT FROM PUBLIC"
db2 "REVOKE EXECUTE ON FUNCTION SYSPROC.MON_GET_ACTIVITY FROM PUBLIC"
db2 "REVOKE SELECT ON SYSIBMADM.MON_CURRENT_SQL FROM PUBLIC"