CVE-2025-13755

MEDIUM

IBM® Db2® is vulnerable to credential exposure in db2diag when executing specific testcase buckets

Title source: cna

Description

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes DB2 Connect Server) stores potentially sensitive information in log files that could be read by a local user.

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory patch

https://www.ibm.com/support/pages/node/7273554

Scores

CVSS v3 5.5

EPSS 0.0014

EPSS Percentile 3.9%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-532

Status published

Products (3)

IBM/Db2 11.5.0 - 11.5.9

ibm/db2 11.5.0 - 11.5.9 (3 CPE variants)

IBM/Db2 12.1.0 - 12.1.4

Published May 26, 2026

Tracked Since May 26, 2026