CVE-2025-27897: IBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site Scripting

Published Oct 12, 2026

Updated

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected Software

1 affected component

IBM DB2 Recovery Expert for Linux, UNIX and Windows=5.5 IF 2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Db2 Recovery Expert for Linux, Unix and Windows to a version that resolves this vulnerability.
Fixed in v12.1

Event History

Oct 12, 2026

CVE Published

via MITRE·07:05 PM

Data Sourced

via MITRE·07:05 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker do to exploit this issue?

An attacker must cause a user to interact with the malicious content in the Web UI. The vulnerability can be exploited without authentication and allows arbitrary JavaScript to run in the context of a trusted session.

Who is at risk from successful exploitation?

Users of the affected Web UI are at risk, particularly users with active trusted sessions. Successful exploitation could disclose credentials and alter intended Web UI functionality.

Which deployment is identified as affected?

The affected release identified is IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2.