CVE-2026-109838: Medium severity IBM Db2 intelligence center vulnerability

Q: Who is realistically exposed to this issue?

Systems running IBM Db2 Genius Hub 1.0 are affected according to the available information. Exploitation requires local access to the affected system.

Q: Does an attacker need an account or user interaction to exploit this?

The supplied CVSS vector indicates no privileges are required and no user interaction is required. However, the attacker must be able to execute actions locally on the affected host.

Q: What is the likely impact if exploitation succeeds?

The stated impact is disclosure of sensitive information. The CVSS vector also indicates low confidentiality and low integrity impact, with no availability impact.

Published Oct 14, 2026

Updated

IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptographic signature.

Other sources

IBM Db2 Genius Hub could allow a local attacker to obtain sensitive information due to improper verification of cryptographic signature.

— IBM

Affected Software

1 affected componentFixes available

IBM Db2 intelligence center<=1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Db2 Genius Hub to a version that resolves this vulnerability.
Fixed in 1.1.0

Event History

Oct 14, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Oct 16, 2026

CVE Published

via MITRE·05:44 PM

Data Sourced

via MITRE·05:44 PM

RemedyDescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7292486

Frequently Asked Questions

Who is realistically exposed to this issue?

Systems running IBM Db2 Genius Hub 1.0 are affected according to the available information. Exploitation requires local access to the affected system.

Does an attacker need an account or user interaction to exploit this?

The supplied CVSS vector indicates no privileges are required and no user interaction is required. However, the attacker must be able to execute actions locally on the affected host.

What is the likely impact if exploitation succeeds?

The stated impact is disclosure of sensitive information. The CVSS vector also indicates low confidentiality and low integrity impact, with no availability impact.

CVE-2026-109838: Medium severity IBM Db2 intelligence center vulnerability

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who is realistically exposed to this issue?

Does an attacker need an account or user interaction to exploit this?

What is the likely impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

Does an attacker need an account or user interaction to exploit this?

What is the likely impact if exploitation succeeds?