CVE-2026-105464: IBM® Db2® is vulnerable to a local attacker with DBADM authorization gaining elevated privileges due to improper privilege management
DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevated privileges due to improper privilege management.
Other sources
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevated privileges due to improper privilege management.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Db2 V11.5to a version that resolves this vulnerability.Patch Security Update #94236 - Upgrade
Upgrade
IBM Db2 V12.1.4to a version that resolves this vulnerability.Patch Security Update #94722 - Upgrade
Upgrade
IBM Db2 V12.1.5to a version that resolves this vulnerability.Patch Security Update #94858
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must have local access to the affected Db2 host and DBADM authorization. The issue affects Db2 for Linux, UNIX, and Windows, including Db2 Connect Server.
Which releases are affected?
Affected releases are Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5.
What is the potential impact after exploitation?
A local attacker with DBADM authorization could gain elevated privileges. The provided severity vector indicates impacts to confidentiality, integrity, and availability, with scope changed.