CVE-2026-105465: IBM® Db2® is vulnerable to privilege escalation when db2ssh is enabled with the db2 instance

Q: Which Db2 deployments are affected?

Affected versions are IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5, where db2locssh is enabled with the Db2 instance.

Q: What access does an attacker need to exploit this issue?

The CVSS vector indicates local access and low privileges are required. No user interaction is required.

Q: Is an instance affected if the SSH-related feature is not enabled?

The vulnerability is described as applying when db2locssh is enabled with the Db2 instance. The provided information does not identify instances without db2locssh enabled as affected.

Published Oct 12, 2026

Updated

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance.

Affected Software

1 affected component

IBM DB2>=11.5.0<=11.5.9, >=12.1.0<=12.1.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Db2 to a version that resolves this vulnerability.
Patch #94858

Event History

Oct 12, 2026

CVE Published

via MITRE·06:41 PM

Data Sourced

via MITRE·06:41 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Db2 deployments are affected?

Affected versions are IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5, where db2locssh is enabled with the Db2 instance.

What access does an attacker need to exploit this issue?

The CVSS vector indicates local access and low privileges are required. No user interaction is required.

Is an instance affected if the SSH-related feature is not enabled?

The vulnerability is described as applying when db2locssh is enabled with the Db2 instance. The provided information does not identify instances without db2locssh enabled as affected.

CVE-2026-105465: IBM® Db2® is vulnerable to privilege escalation when db2ssh is enabled with the db2 instance

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Db2 deployments are affected?

What access does an attacker need to exploit this issue?

Is an instance affected if the SSH-related feature is not enabled?

Company

Resources

Contact

Frequently Asked Questions

Which Db2 deployments are affected?

What access does an attacker need to exploit this issue?

Is an instance affected if the SSH-related feature is not enabled?