IBM DB2 Recovery Expert vulnerabilities

10 CVEs affecting IBM DB2 Recovery Expert, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-3856, published 2026-03-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-4024, published 2013-09-25. Medium severity, CVSS 4.3. EPSS: 1.1% chance of exploitation in the next 30 days. IBM Data Studio Web Console 3.x before 3.2, Optim Performance Manager 5.x before 5.2, InfoSphere Optim Configuration Manager 2.x before 2.2, and DB2 Recovery Expert 2.x support HTTP access to the Web…
CVE-2013-4022, published 2013-09-25. Low severity, CVSS 3.5. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Data Studio Web Console 3.x before 3.2, Optim Performance Manager 5.x before 5.2, InfoSphere Optim Configuration Manager 2.x before 2.2, and DB2 Recovery Expert 2.x store unspecified…
CVE-2013-4025, published 2013-09-25. Low severity, CVSS 1.9. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Data Studio Web Console 3.x before 3.2, Optim Performance Manager 5.x before 5.2, InfoSphere Optim Configuration Manager 2.x before 2.2, and DB2 Recovery Expert 2.x do not have an off…
CVE-2025-27899, published 2026-02-17. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 discloses sensitive information in an environment variable that could aid in further attacks against the system.
CVE-2025-27901, published 2026-02-17. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 IBM Db2 Recovery Expert for Linux, UNIX and Windows is vulnerable to HTTP header injection, caused by improper validation of input by the HOST…
CVE-2026-3856, published 2026-03-17. Critical severity, CVSS 9.1. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 could allow an attacker to modify or corrupt data due to an insecure mechanism used for verifying the integrity of the data during…
CVE-2025-27898, published 2026-02-17. Medium severity, CVSS 6.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 does not invalidate session after a timeout which could allow an authenticated user to impersonate another user on the system.
CVE-2025-27900, published 2026-02-17. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web…
CVE-2025-27903, published 2026-02-17. Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days. IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 IBM Db2 Recovery Expert for Linux, UNIX and Windows transmits data in a cleartext communication channel that could allow an attacker to obtain…
CVE-2025-27904, published 2026-02-17. Medium severity, CVSS 6.5. EPSS: 0.1% chance of exploitation in the next 30 days. IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 IBM Db2 Recovery Expert for Linux, UNIX and Windows is vulnerable to cross-site request forgery which could allow an attacker to execute malicious…