Medium severity · published Feb 17, 2026
CVE-2025-27899
Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 discloses sensitive information in an environment variable that could aid in further attacks against the system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DR
DB2 Recovery Expert for LUW · IBM
5.5 Interim Fix 002 · source: vendor
DR
Db2 Recovery Expert · Ibm
5.5.0; 5.5.0; 5.5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-27899
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-27899
Patch
https://www.ibm.com/support/pages/node/7259901
More from DB2 Recovery Expert for LUW
6.5
CVE-2025-27901
Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows
6.5
CVE-2025-27904
Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows
6.3
CVE-2025-27898
Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows
6.1
CVE-2025-27900
Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows
5.9
CVE-2025-27903
Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows