CVE-2025-27904: CSRF in IBM DB2 Recovery Expert

A successful CSRF attack could allow an attacker to execute malicious and unauthorized actions within the context of a legitimate user's session. This could involve modifying recovery configurations, initiating unintended recovery operations, or potentially gaining access to sensitive data related to database recovery processes. The blast radius is limited to the scope of actions that can be performed through the DB2 Recovery Expert interface, but the impact on data integrity and availability could be significant if critical recovery procedures are manipulated. While not directly leading to remote code execution, a CSRF in a recovery tool could be leveraged to disrupt database operations and potentially cause data loss.

1. Reserved2025-03-10
2. Published2026-02-17
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-27904 is to upgrade to IBM DB2 Recovery Expert for LUW version 5.5.1 or later. If an immediate upgrade is not feasible, consider implementing strict input validation and output encoding within the application to prevent malicious requests from being processed. Implementing a Content Security Policy (CSP) can also help mitigate CSRF attacks by restricting the sources from which scripts can be executed. Review and restrict user permissions within the DB2 Recovery Expert interface to limit the potential impact of a successful CSRF attack.