CVE-2025-36247

HIGH

IBM Db2 11.5.0-11.5.9/12.1.0-12.1.3 - XXE

Title source: llm

Description

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

References (1)

[Various Sources] https://www.ibm.com/support/pages/node/7259961

Scores

CVSS v3 7.1

EPSS 0.0018

EPSS Percentile 38.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Classification

CWE

CWE-611

Status published

Affected Products (3)

ibm/db2 < 11.5.9

Timeline

Published Feb 17, 2026

Tracked Since Feb 18, 2026