CVE-2025-27896
6.1MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Remote attackers can execute arbitrary JavaScript in the victim's browser session to steal credentials. Exploitation requires an unauthenticated attacker to trick an authenticated user into clicking a malicious link or accessing tainted Web UI input.
Root cause
The Web UI fails to sanitize user-supplied input before rendering it, leading to reflected or stored cross-site scripting.
Affected systems
IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Fix & remediation
Upgrade to the vendor-provided patch listed in IBM advisory 7290893. If patching immediately is not possible, restrict network access to the Db2 Recovery Expert Web UI to trusted administrative networks.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.