Skip to content
OpenAdvisories
High WID-SEC-2026-3837 8 CVEs

IBM DB2: Mehrere Schwachstellen

Published Oct 8, 2026 · Updated Nov 8, 2026 · Revision 5 · de

Vendor: IBM Product: Db2 Product: License Metric Tool Product: Tivoli Key Lifecycle Manager Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen und um Informationen offenzulegen.

Product

IBM DB2 ist ein relationales Datenbanksystem (RDBS) von IBM.

Vulnerabilities 8

  • High 8.8
    CVE-2026-105464

    IBM® Db2® is vulnerable to a local attacker with DBADM authorization gaining elevated privileges due to improper privilege management

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevated privileges due to improper privilege management.

    IBM Db2
  • High 8.8
    CVE-2026-105465

    IBM® Db2® is vulnerable to privilege escalation when db2ssh is enabled with the db2 instance

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance.

    IBM Db2
  • High 7.7
    CVE-2026-18166

    IBM® Db2® is vulnerable to arbitrary library loading via the CREATE WRAPPER command, allowing a privileged database user to read sensitive files from the host filesystem

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitive information due to improper authorization when using the CREATE WRAPPER command.

    IBM Db2
  • Medium 6.5
    CVE-2026-105466

    IBM® Db2® is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions.

    IBM Db2
  • Medium 6.5
    CVE-2026-113698

    IBM® Db2® is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table.

    IBM Db2
  • Medium 6.5
    CVE-2026-78404

    IBM® Db2® is vulnerable to local privilege escalation via the db2pd utility

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility.

    IBM Db2
  • Medium 5.5
    CVE-2026-104332

    IBM® Db2® Denial of Service

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table

    IBM Db2
  • Low 3.3
    CVE-2026-104364

    IBM® Db2® Denial of Service

    IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due to improper input validation.

    IBM Db2

Revision history

  1. #5

    Referenz(en) aufgenommen: CVE-2026-113698, EUVD-2026-119689

  2. #4

    Neue Updates von IBM aufgenommen

  3. #3

    Neue Updates von IBM aufgenommen

  4. #2

    Referenz(en) aufgenommen: EUVD-2026-97772, EUVD-2026-97771, EUVD-2026-97767, EUVD-2026-97765, EUVD-2026-97764, EUVD-2026-97813, EUVD-2026-97784

  5. #1

    Initiale Fassung

References