CVE-2026-105465: IBM® Db2® is vulnerable to privilege escalation when db2ssh is enabled with the db2 instance
Published Oct 12, 2026
·Updated
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance.
Affected Software
1 affected component
IBM DB2>=11.5.0<=11.5.9, >=12.1.0<=12.1.5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Db2to a version that resolves this vulnerability.Patch #94858
Event History
Oct 12, 2026
CVE Published
via MITRE·06:41 PM
Data Sourced
via MITRE·06:41 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·07:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which Db2 deployments are affected?
Affected versions are IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5, where db2locssh is enabled with the Db2 instance.
2
What access does an attacker need to exploit this issue?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
3
Is an instance affected if the SSH-related feature is not enabled?
The vulnerability is described as applying when db2locssh is enabled with the Db2 instance. The provided information does not identify instances without db2locssh enabled as affected.