CVE-2025-2669: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-22 · updated 2026-10-06
Weakness: CWE-295

Description

IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, 5.3 could allow a privileged user to perform operations and obtain sensitive information outside of their authority due to improper token validation.

Affected products

IBM Db2 for Linux, UNIX and Windows: from 4.8 before 5.4 — fixed in 5.4
IBM Db2 Warehouse: from 4.8 before 5.4 — fixed in 5.4

How to fix

Upgrade to a fixed version: IBM Db2 for Linux, UNIX and Windows 5.4; IBM Db2 Warehouse 5.4. Check the vendor advisory for mitigations.

References

https://www.ibm.com/support/pages/node/7277112

Get alerted when CVE-2025-2669 or the next vulnerability affects your stack