# CVE-2025-13755: IBM Db2 sensitive information disclosure in db2diag logs

Source: https://junglewise.ai/threats/cve-2025-13755-ibm-db2-sensitive-information-disclosure-in-db2diag-logs  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2025-13755 · Severity: medium · CVSS 5.5 · Published 2026-05-26

IBM Db2, a widely used enterprise database system, is vulnerable to a security flaw where sensitive information, such as user credentials, is inadvertently written to system log files. An individual with local access to the server could read these logs to obtain sensitive data, potentially leading to unauthorized database access or further compromise of the system. This issue affects various versions of Db2 running on Linux, UNIX, and Windows platforms.

Technologies: [IBM DB2 Connect Server](https://junglewise.ai/threats/technologies/db2-connect-server), [IBM Db2 for Linux, UNIX and Windows](https://junglewise.ai/threats/technologies/db2-for-linux-unix-and-windows). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2025-13755 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-13755 being exploited in the wild.

**How severe is CVE-2025-13755?** Medium severity, with a CVSS score of 5.5, published 26 May 2026.

**Which products and versions are affected?** IBM DB2 Connect Server 11.5.0 - 11.5.9, 12.1.0 - 12.1.4; IBM Db2 for Linux, UNIX and Windows 11.5.0 - 11.5.9, 12.1.0 - 12.1.4.

**Is there a fix for CVE-2025-13755?** A patch was published on 2026-05-25: Updated workaround and fix information provided Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-13755 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2025-13755?** Check whether you run IBM DB2 Connect Server, IBM Db2 for Linux or UNIX and Windows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

IBM Db2 is vulnerable to an information disclosure vulnerability (CWE-532) in the db2diag logging component. The vulnerability occurs when specific testcase buckets are executed, causing the system to write potentially sensitive information, including credentials, into log files. A local attacker with low privileges can read these logs to extract sensitive data. The issue affects versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 on Linux, UNIX, and Windows. IBM has released special builds to remediate the issue and suggests reducing the diagnostic level (diaglevel) as a temporary mitigation.

## Affected products

- IBM Db2 for Linux, UNIX and Windows 11.5.0 - 11.5.9, 12.1.0 - 12.1.4
- IBM DB2 Connect Server 11.5.0 - 11.5.9, 12.1.0 - 12.1.4

## Timeline

- 2026-05-21: disclosed: Initial publication of the security bulletin
- 2026-05-25: patched: Updated workaround and fix information provided
- 2026-05-26: advisory: NVD publication date

## References

- [https://www.ibm.com/support/pages/node/7273554](https://www.ibm.com/support/pages/node/7273554)

## Related threats

- [IBM Db2 arbitrary library loading via CREATE WRAPPER](https://junglewise.ai/threats/cve-2026-18166-ibm-db2-11-5-0-through-11-5-9-and-12-1-0-through-12-1-5-for-linux)
- [IBM Db2 denial of service in resource consumption](https://junglewise.ai/threats/cve-2026-17463-ibm-db2-denial-of-service-in-resource-consumption)
- [IBM Db2 null pointer dereference in federated server](https://junglewise.ai/threats/cve-2026-16702-ibm-db2-null-pointer-dereference-in-federated-server)
- [IBM Db2 plain text password logging in trace files](https://junglewise.ai/threats/cve-2026-18097-ibm-db2-plain-text-password-logging-in-trace-files)
- [IBM Db2 denial of service in XMLTable query logic](https://junglewise.ai/threats/cve-2026-11906-ibm-db2-denial-of-service-in-xmltable-query-logic)