CVE-2025-36184: IBM Db2 Privilege Escalation

CVE-2025-36184 PUBLISHED CVSS 7.2 HIGH

IBM Db2 Privilege Escalation

Reported by ibm · Published January 30, 2026

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 could allow an instance owner to execute malicious code that escalate their privileges to root due to execution of unnecessary privileges operated at a higher than minimum level.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
db2	ibm	11.5.9
Db2 for Linux, UNIX and Windows	IBM	11.5.9

Risk scores

CVSS 3.1

7.2

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Vendor	Product	Versions
IBM	Db2 for Linux, UNIX and Windows	11.5.0
IBM	Db2 for Linux, UNIX and Windows	11.5.0

Timeline

Jan 29, 2026 CVE Published
Jan 31, 2026 EPSS Score (30 in total, the first dated here)
May 17, 2026 Security Advisory
Jun 10, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2025-36184
vulnetix vdb fixes CVE-2025-36184

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-36184/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

vendor-advisorypatch

Look up in the Resolve Platform →