CVE-2026-18166: IBM® Db2® is vulnerable to arbitrary library loading via the CREATE WRAPPER command, allowing a privileged database user to read sensitive files from the host filesystem

Q: Which Db2 deployments are affected?

The affected releases are IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX, and Windows, including Db2 Connect Server.

Q: What access does an attacker need?

An attacker must be remotely authenticated and have the database privileges needed to use the CREATE WRAPPER command. No user interaction is required.

Q: What is the impact of successful exploitation?

A successful attacker can load arbitrary libraries through CREATE WRAPPER and read sensitive files from the host filesystem. The stated impact is disclosure of sensitive information; integrity and availability impacts are not indicated.

Published Oct 8, 2026

Updated

DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitive information due to improper authorization when using the CREATE WRAPPER command.

Other sources

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitive information due to improper authorization when using the CREATE WRAPPER command.

— MITRE

Affected Software

3 affected components

IBM DB2>=11.5.0<=11.5.9, >=12.1.0<=12.1.5

IBM IBM® Db2®<=11.5.0 - 11.5.9

IBM IBM® Db2®<=12.1.0 - 12.1.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Db2 to a version that resolves this vulnerability.
Fixed in 11.5.9Patch Security Update #94236
Upgrade
Upgrade IBM Db2 to a version that resolves this vulnerability.
Fixed in 12.1.4Patch Security Update #94722
Upgrade
Upgrade IBM Db2 to a version that resolves this vulnerability.
Fixed in 12.1.5Patch Security Update #94858

Event History

Oct 8, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Oct 12, 2026

CVE Published

via MITRE·06:47 PM

Data Sourced

via MITRE·06:47 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7291606

Frequently Asked Questions

Which Db2 deployments are affected?

The affected releases are IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX, and Windows, including Db2 Connect Server.

What access does an attacker need?

An attacker must be remotely authenticated and have the database privileges needed to use the CREATE WRAPPER command. No user interaction is required.

What is the impact of successful exploitation?

A successful attacker can load arbitrary libraries through CREATE WRAPPER and read sensitive files from the host filesystem. The stated impact is disclosure of sensitive information; integrity and availability impacts are not indicated.

CVE-2026-18166: IBM® Db2® is vulnerable to arbitrary library loading via the CREATE WRAPPER command, allowing a privileged database user to read sensitive files from the host filesystem

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Which Db2 deployments are affected?

What access does an attacker need?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which Db2 deployments are affected?

What access does an attacker need?

What is the impact of successful exploitation?