Root vulnerability threatens IBM's Db2 database system

Security updates close several vulnerabilities in IBM Db2 and Business Automation Workflow.

(Image: AFANASEV IVAN/Shutterstock.com)

Nov 11, 2025 at 12:45 pm CET

3 min. read

By

Dennis Schirrmacher

Attackers can attack systems with IBM Db2 and Business Automation Workflow and, in the worst case, gain root privileges to compromise PCs. Security patches are available for download.

Multiple Software Vulnerabilities

As stated in a warning message, Business Automation can be attacked via three security vulnerabilities classified as “medium” (CVE-2025-54121, CVE-2025-50181, CVE-2025-50182). If attacks are successful, users will no longer be able to establish new connections to the application, for example. Version 24.0.0-IF007, on the other hand, is equipped to handle this.

Since listing all recently closed security vulnerabilities in Db2 and security patches would go beyond the scope of this report, administrators can find further information in the warning messages linked below this post. Here, we will only address the most dangerous vulnerabilities.

Thus, remote attackers can, for example, access actually protected information. Apparently, no CVE number has been assigned to this vulnerability yet. The starting point is the lack of input validation in the context of Apache Commons Codec.

In certain, undescribed configurations, local attackers can execute malicious code and subsequently escalate to root user (CVE-2025-36186 “high”). In such a position, attackers generally gain full control over systems.

Furthermore, DoS attacks and unauthorized access to instances are also possible, among other things.

Videos by heise