CVE-2025-36371
📋 TL;DR
IBM i operating systems (versions 7.2-7.6) have an information disclosure vulnerability in the database plan cache implementation. Authenticated users with access to the plan cache can view unauthorized database information. This affects all IBM i systems running vulnerable versions.
💻 Affected Systems
- IBM i
📦 What is this software?
I by Ibm
I by Ibm
I by Ibm
I by Ibm
I by Ibm
⚠️ Risk & Real-World Impact
Worst Case
Privileged database information exposure including sensitive business data, PII, or credentials could lead to data breaches and regulatory violations.
Likely Case
Unauthorized viewing of database query plans and metadata, potentially revealing sensitive data structures and business logic.
If Mitigated
Limited exposure of non-critical database metadata with proper access controls and monitoring in place.
🎯 Exploit Status
Requires authenticated database user access to the plan cache. No public exploit code available as of analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply IBM i PTF groups as specified in IBM advisory
Vendor Advisory: https://www.ibm.com/support/pages/node/7251699
Restart Required: Yes
Instructions:
1. Review IBM advisory for specific PTF requirements. 2. Apply required PTF groups for your IBM i version. 3. Restart the system as required by PTF installation.
🔧 Temporary Workarounds
Restrict Database Plan Cache Access
ibmiLimit user access to database plan cache functionality through IBM i authority settings
Use IBM i authority management (WRKAUT, GRTOBJAUT, etc.) to restrict *USE authority to plan cache objects
🧯 If You Can't Patch
- Implement strict access controls to limit which users can access database plan cache functionality
- Monitor database plan cache access logs for suspicious activity and unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check IBM i version with DSPPTF command and compare against IBM advisory for missing PTFsCheck Version:
DSPPTFVerify Fix Applied:
Verify PTF installation with WRKPTFGRP command and confirm all required PTF groups are applied📡 Detection & Monitoring
Log Indicators:
- Unusual database plan cache access patterns
- Multiple failed plan cache access attempts
- User accessing plan cache objects they shouldn't have authority for
Network Indicators:
- Database connection attempts to plan cache from unauthorized users
SIEM Query:
source="ibm_i" AND (event_type="database_access" AND object="plan_cache*")