CVE-2026-16480: IBM® Db2® is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data.
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data.
Other sources
IBM Db2 is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Db2 11.5to a version that resolves this vulnerability.Fixed in 11.5.9Patch Security Update #88454 - Upgrade
Upgrade
IBM Db2 12.1to a version that resolves this vulnerability.Fixed in 12.1.4Patch Security Update #88454 - Upgrade
Upgrade
IBM Db2 12.1to a version that resolves this vulnerability.Fixed in 12.1.5Patch Security Update #88454
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16480?
The severity of CVE-2026-16480 is rated as medium with a CVSS score of 4.3.
How does CVE-2026-16480 affect IBM Db2?
CVE-2026-16480 allows a non-privileged user to bypass authority checks and modify database catalog data in IBM Db2.
Which versions of IBM Db2 are affected by CVE-2026-16480?
IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 are affected by CVE-2026-16480.
How can I mitigate the risks associated with CVE-2026-16480?
To mitigate CVE-2026-16480, ensure that only authorized users have access to commands that could be affected by this vulnerability.
What type of vulnerability is CVE-2026-16480?
CVE-2026-16480 is classified as an improper authorization vulnerability.