CVE-2025-36372 MEDIUM

CVE-2025-36372: IBM® Db2® could disclose sensitive information to an authenticated user from the monitoring and event tables

Vendor Ibm
Product Db2
Weakness CWE-538
Published June 30, 2026
Last update July 1, 2026
View on NVD All CVEs

CVSS base score

5.5/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information to an authenticated user from the monitoring and event tables.

Key dates

02Disclosure timeline

June 30, 2026 CVE published
July 1, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2021-1406 Cisco Unified Communications Manager Information Disclosure Vulnerability CVE-2025-11891 Shelf Planner <= 2.8.1 - Unauthenticated Information Exposure via Log Files CVE-2024-51977 Unauthenticated leak of sensitive information affecting multiple models from Brother Industries, Ltd., FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc. CVE-2026-7071 CodeAstro Online Job Portal user-cvs file information disclosure CVE-2025-36051 IBM QRadar SIEM Information Disclosure