CVE-2025-27899— Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows
Quick assessment
Affected
IBM DB2 Recovery Expert for LUW
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
IBM Db2是美国国际商业机器（IBM）公司的一套关系型数据库管理系统。该系统的执行环境主要有UNIX、Linux、IBMi、z/OS以及Windows服务器版本。 IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002版本存在安全漏洞，该漏洞源于环境变量泄露敏感信息，可能有助于进一步攻击。
Possible ATT&CK Techniques 1 AI
T1552.001 · Credentials In Files
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-27899
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows
Source: CVE Program / CVE List V5
Vulnerability Description
IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 discloses sensitive information in an environment variable that could aid in further attacks against the system.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过环境变量导致的信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
IBM Db2 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
IBM Db2是美国国际商业机器（IBM）公司的一套关系型数据库管理系统。该系统的执行环境主要有UNIX、Linux、IBMi、z/OS以及Windows服务器版本。 IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002版本存在安全漏洞，该漏洞源于环境变量泄露敏感信息，可能有助于进一步攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| IBM | DB2 Recovery Expert for LUW | 5.5 Interim Fix 002 |
cpe:2.3:a:ibm:db2_recovery_expert_for_luw:5.5:interim_fix_002:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2025-27899
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-27899
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-27899 (1)
Same Patch Batch · IBM · 2026-02-17 · 33 CVEs total
| CVE-2025-13689 | 8.8 HIGH | DataStage on Cloud Pak for Data is vulnerable to arbitrary code injection due to runtime e |
| CVE-2025-13691 | 8.1 HIGH | DataStage on Cloud Pak for Data is vulnerable to sensitive information leaks due to HTTP p |
| CVE-2025-33088 | 7.4 HIGH | Multiple Vulnerabilities in IBM Concert Software. |
| CVE-2025-36247 | 7.1 HIGH | IBM Db2 XML External Entity Reference |
| CVE-2025-27900 | 6.8 MEDIUM | Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and |
| CVE-2025-14689 | 6.5 MEDIUM | IBM Db2 Denial of Service |
| CVE-2025-13867 | 6.5 MEDIUM | IBM Db2 Denial of Service |
| CVE-2025-36018 | 6.5 MEDIUM | Multiple Vulnerabilities in IBM Concert Software. |
| CVE-2025-33089 | 6.5 MEDIUM | Multiple Vulnerabilities in IBM Concert Software. |
| CVE-2025-33124 | 6.5 MEDIUM | Fixes to common vulnerabilities found in IBM Db2 Merge Backup for Linux, UNIX and Windows |
| CVE-2025-33130 | 6.5 MEDIUM | Fixes to common vulnerabilities found in IBM Db2 Merge Backup for Linux, UNIX and Windows |
| CVE-2025-27904 | 6.5 MEDIUM | Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and |
| CVE-2025-27901 | 6.5 MEDIUM | Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and |
| CVE-2025-36377 | 6.3 MEDIUM | IBM Security QRadar EDR Software has multiple vulnerabilities |
| CVE-2025-36376 | 6.3 MEDIUM | IBM Security QRadar EDR Software has multiple vulnerabilities |
| CVE-2025-27898 | 6.3 MEDIUM | Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and |
| CVE-2025-36019 | 6.1 MEDIUM | Multiple Vulnerabilities in IBM Concert Software. |
| CVE-2025-33135 | 6.1 MEDIUM | IBM Financial Transaction Manager for ACH Services and Check Services is impacted by multi |
| CVE-2025-27903 | 5.9 MEDIUM | Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and |
| CVE-2025-36379 | 5.9 MEDIUM | IBM Security QRadar EDR Software has multiple vulnerabilities |
Showing top 20 of 33 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: DB2 Recovery Expert for LUW
-
CVE-2025-27898
Multiple vulnerabilities in IBM Java SDK affecting Db2 Recov -
CVE-2025-27900
Multiple vulnerabilities in IBM Java SDK affecting Db2 Recov -
CVE-2025-27901
Multiple vulnerabilities in IBM Java SDK affecting Db2 Recov -
CVE-2025-27903
Multiple vulnerabilities in IBM Java SDK affecting Db2 Recov -
CVE-2025-27904
Multiple vulnerabilities in IBM Java SDK affecting Db2 Recov
Same vendor: IBM
-
CVE-2026-84414
IBM i is Affected By An Incorrect Permission Assignment Vuln -
CVE-2026-84421
DataStage on Cloud Pak for Data has several vulnerabilities -
CVE-2026-84422
IBM Guardium Data Protection is affected by multiple vulnera -
CVE-2026-84436
IBM Guardium Data Protection is affected by multiple vulnera -
CVE-2026-84440
IBM Guardium Data Protection is affected by multiple vulnera
Same weakness: CWE-526
-
CVE-2026-76227
Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Env -
CVE-2026-72648
Cleartext Storage of Sensitive Information in an Environment -
CVE-2026-49377
JetBrains TeamCity 安全漏洞 -
CVE-2026-45370
python-utcp: Full Process Environment Exposed to CLI Subproc -
CVE-2026-40153
PraisonAIAgents Affected by Environment Variable Secret Exfi
V. Comments for CVE-2025-27899
No comments yet