Skip to content
OpenAdvisories
High WID-SEC-2026-3308 7 CVEs

IBM DB2: Mehrere Schwachstellen

Published Sep 10, 2026 · Updated Oct 25, 2026 · Revision 3 · de-DE

Vendor: IBM Product: Db2 Product: License Metric Tool Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um beliebigen Programmcode auszuführen, beliebige Dateien zu schreiben, Daten zu manipulieren, sensible Informationen offenzulegen oder Denial-of-Service-Zustände zu verursachen.

Product

IBM DB2 ist ein relationales Datenbanksystem (RDBS) von IBM.

Vulnerabilities 7

  • Critical 9.3
    CVE-2026-41586

    ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE

    Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject() and exposes deSerializeChannel() which call ObjectInputStream.re…

    hyperledger fabric org.hyperledger.fabric-sdk-java:fabric-sdk-java Maven
  • High 8.1
    CVE-2026-87958

    IBM® Db2® is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions.

    IBM Db2
  • High 7.5
    CVE-2026-86093

    IBM® Db2® federated server could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands under certain conditions

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands on Db2 clients due to a stack-based buffer overflow that improperly copies user-co…

    IBM Db2
  • Medium 6.5
    CVE-2026-16702

    IBM® Db2® federated server could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference.

    IBM Db2
  • Medium 6.5
    CVE-2026-17463

    IBM® Db2® could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption.

    IBM Db2
  • Medium 5.5
    CVE-2026-0636

    LDAP Injection Vulnerability in LDAPStoreHelper.java

    Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper. This issue affect…

    Legion of the Bouncy Castle BC-JAVA druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 4.3
    CVE-2026-86087

    IBM® Db2® could allow an authenticated user to send a specially crafted request to write arbitrary files on the system

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbitrary files on the system.

    IBM Db2

Revision history

  1. #3

    Neue Updates von IBM aufgenommen

  2. #2

    Referenz(en) aufgenommen: EUVD-2026-77788, EUVD-2026-77784

  3. #1

    Initiale Fassung

References