CVE-2026-10543: IBM® Db2® is vulnerable to privilege escalation with a specially crafted query
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query.
Other sources
IBM Db2 is vulnerable to privilege escalation with a specially crafted query.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Db2 V11.5 (impacted releases 11.5.0 through 11.5.9)to a version that resolves this vulnerability.Fixed in V11.5.9 - Upgrade
Upgrade
IBM Db2 V12.1 (impacted releases 12.1.0 through 12.1.5)to a version that resolves this vulnerability.Fixed in V12.1.4 - Upgrade
Upgrade
IBM Db2 V12.1.5to a version that resolves this vulnerability.Fixed in V12.1.5Patch Security Update #88454 - Compensating control
For the interim remediation, use the security update containing the interim fix for the issue from Fix Central, as referenced in the provided IBM statement (Security Update #88454 or later for V12.1.5).
- Operational
After applying the security update, verify the Db2 environment is on the latest levels specified by IBM for remediation (V11.5.9, V12.1.4, or V12.1.5) for the impacted release you run.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10543?
CVE-2026-10543 has a high severity rating with a score of 8.2.
How do I fix CVE-2026-10543?
To mitigate CVE-2026-10543, upgrade to the latest release of IBM Db2 beyond version 12.1.5.
What systems are affected by CVE-2026-10543?
CVE-2026-10543 affects IBM Db2 versions 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5.
What type of vulnerability is CVE-2026-10543?
CVE-2026-10543 is a privilege escalation vulnerability that can be exploited with a specially crafted query.
Can CVE-2026-10543 be exploited remotely?
Yes, CVE-2026-10543 can be exploited remotely, as it allows unauthorized users to escalate privileges.