CVE-2026-105464: IBM® Db2® is vulnerable to a local attacker with DBADM authorization gaining elevated privileges due to improper privilege management
Published Oct 8, 2026
·Updated
DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevated privileges due to improper privilege management.
Other sources
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevated privileges due to improper privilege management.
— MITRE
Affected Software
3 affected components
IBM DB2>=11.5.0<=11.5.9, >=12.1.0<=12.1.5
IBM IBM® Db2®<=11.5.0 - 11.5.9
IBM IBM® Db2®<=12.1.0 - 12.1.5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Db2 V11.5to a version that resolves this vulnerability.Patch Security Update #94236 - Upgrade
Upgrade
IBM Db2 V12.1.4to a version that resolves this vulnerability.Patch Security Update #94722 - Upgrade
Upgrade
IBM Db2 V12.1.5to a version that resolves this vulnerability.Patch Security Update #94858
Event History
Oct 8, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Oct 12, 2026
CVE Published
via MITRE·06:46 PM
Data Sourced
via MITRE·06:46 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·07:16 PM
DescriptionSeverityWeakness