What’s Vulnerable › Vulnerabilities
CVE-2025-36116: IBM Db2 Mirror for i cross-site websocket hijacking
- Severity: medium (CVSS 6.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-07-23 · updated 2026-06-17
- Weakness: CWE-1385
Description
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 GUI is affected by cross-site WebSocket hijacking vulnerability. By sending a specially crafted request, an unauthenticated malicious actor could exploit this vulnerability to sniff an existing WebSocket connection to then remotely perform operations that the user is not allowed to perform.
Affected products
- IBM Db2 Mirror for i: 7.4, 7.5, 7.6
References
Get alerted when CVE-2025-36116 or the next vulnerability affects your stack