CVE-2026-78404: IBM® Db2® is vulnerable to local privilege escalation via the db2pd utility
Published Oct 12, 2026
·Updated
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility.
Affected Software
1 affected component
IBM DB2>=11.5.0<=11.5.9, >=12.1.0<=12.1.5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Db2to a version that resolves this vulnerability.Patch Security Update #94858
Event History
Oct 12, 2026
CVE Published
via MITRE·06:39 PM
Data Sourced
via MITRE·06:39 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·07:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which Db2 versions are affected?
Affected versions are Db2 11.5.0 through 11.5.9 and Db2 12.1.0 through 12.1.5.
2
What level of access does an attacker need?
Exploitation requires local access and low-level privileges. No user interaction is required.
3
What is the impact of successful exploitation?
A successful attacker could escalate privileges locally. The CVSS vector indicates high confidentiality impact, with no indicated integrity or availability impact.