CVE-2025-36247
Published: 17 February 2026
Summary
CVE-2025-36247 is a high-severity Improper Restriction of XML External Entity Reference (CWE-611) vulnerability in Ibm Db2. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked at the 46.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the XXE vulnerability by identifying, reporting, and applying vendor patches as recommended in IBM's security advisory.
Prevents XXE exploitation by validating XML inputs to block malicious external entity references during Db2 XML processing.
Enforces secure configuration of Db2's XML parsers to disable external entity processing and reflect least functionality.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
XXE enables exploitation of remote Db2 service (T1210) for local file disclosure (T1005) and memory exhaustion DoS (T1499.004), matching high confidentiality and low availability impacts.
NVD Description
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to…
more
expose sensitive information or consume memory resources.
Deeper analysisAI
CVE-2025-36247 is an XML external entity injection (XXE) vulnerability, classified under CWE-611, affecting IBM Db2 for Linux, UNIX, and Windows, including Db2 Connect Server, in versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3. The issue occurs when the software processes XML data, potentially allowing injection of malicious external entities.
A remote attacker with low privileges can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation enables disclosure of sensitive information due to high confidentiality impact or consumption of memory resources resulting in limited availability impact, consistent with the CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
IBM provides details on mitigation and patches in their security advisory at https://www.ibm.com/support/pages/node/7259961.
Details
- CWE(s)