CVE-2025-36001

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 6.5EPSS <1%

Published 2026-01-30Updated 2026-08-25

PoC

Vulnerability details

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service using a specially crafted SQL statement including XML that performs uncontrolled recursion.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CNAibm

EPSS score history

Sources

2 links

PoC links are not available for guest users. Login to view them.

CVE Organization NVD Analysis

Profile

CVSS

6.5

EPSS

<1%

Published

2026-01-30

Updated

2026-08-25

CNA

ibm

Vendors

IBM

1 product

CPEs

cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:linux:*:*

cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:unix:*:*

cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:aix:*:*

cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:windows:*:*

cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:zos:*:*

cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:linux:*:*

cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:unix:*:*

cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:aix:*:*

cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:windows:*:*

cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:zos:*:*

cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:linux:*:*

cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:unix:*:*

cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:aix:*:*

cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:windows:*:*

cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:zos:*:*

cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:linux:*:*

cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:unix:*:*

cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:aix:*:*

cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:windows:*:*

cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:zos:*:*

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated