CVE-2025-27902: IBM Db2 Recovery Expert for Linux, Unix and Windows Information Disclosure

Published Oct 12, 2026

Updated

IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser

Affected Software

1 affected component

IBM DB2 Recovery Expert for Linux, UNIX and Windows=5.5 IF 2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM DB2 Recovery Expert for Linux, Unix and Windows to a version that resolves this vulnerability.
Fixed in 12.1

Event History

Oct 12, 2026

CVE Published

via MITRE·07:04 PM

Data Sourced

via MITRE·07:04 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker do to exploit this issue?

An attacker must cause a victim to interact with a web link that contains untrusted references to an external site. The issue is remotely reachable and does not require attacker privileges, but it requires user interaction.

What is the potential impact on an affected user?

Successful exploitation could expose sensitive information or allow unauthorized actions in the victim's web browser. The reported impact includes limited confidentiality and integrity effects, with no availability impact indicated.