Most severe vulnerabilities for "ibm ibm® db2®" 11.5.0 - 11.5.9

Where

AND

Sort:

IBM DB2IBM® Db2® is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling

Risk 86

Severity

9.8

Code Injection

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling.

1 / 2

Source: MITRE

First published (updated )

CVE-2026-10109

IBM DB2IBM® Db2® is vulnerable to privilege escalation with a specially crafted query

Risk 86

Severity

9.8

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query.

1 / 2

Source: MITRE

First published (updated )

CVE-2026-10543

IBM DB2IBM® Db2® is vulnerable to buffer overflow in the IXF IMPORT parser

Risk 86

Severity

9.8

Buffer Overflow

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Db2 is vulnerable to buffer overflow in the IXF IMPORT parser.

1 / 2

Source: IBM

First published (updated )

CVE-2026-10534

IBM DB2IBM Db2 improper account lockout

Risk 79

Severity

8.8

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux could allow an authenticated user to regain access after account lockout due to password use after expiration date.

1 / 2

Source: MITRE

First published (updated )

CVE-2025-33012

IBM DB2IBM® Db2® is vulnerable to buffer overflow in setgid helper db2flacc which can lead to privilege escalation and instance compromise from an unprivileged shell

Risk 74

Severity

8.4

Buffer Overflow

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc.

1 / 2

Source: MITRE

First published (updated )

CVE-2026-10535

IBM IBM® Db2®IBM Db2 XML External Entity Reference

Risk 54

Severity

8.2

XEE

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

1 / 2

Source: NVD

Remedy

Customers running any vulnerable modpack level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, V12.1.2 and V12.1.3. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1 TBD https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads Special Build #74153 or later for V12.1.3 available at this link: https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-36247

IBM IBM® Db2®IBM® Db2® is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions

Risk 60

Severity

8.1

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions.

1 / 2

Source: MITRE

First published (updated )

CVE-2026-87958

IBM DB2IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control

Risk 51

Severity

7.8

EPSS

0.24%

Code Injection

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

IBM Data Server Driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control.

1 / 2

Source: IBM

First published (updated )

CVE-2026-9762

IBM DB2IBM Db2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query

Risk 43

Severity

7.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.

1 / 2

Source: MITRE

First published (updated )

CVE-2024-47118

IBM DB2IBM Db2 denial of service

Risk 43

Severity

7.5

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.

1 / 2

Source: MITRE

First published (updated )

CVE-2025-2534

IBM Db2 for Linux, UNIX and WindowsIBM Db2 Denial of Service

Risk 43

Severity

7.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query with XML columns.

1 / 2

Source: NVD

Remedy

Customers running any vulnerable modpack level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, V12.1.2, and V12.1.3. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1 TBD https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads Special Build #71609 or later for V12.1.3 available at this link: https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-36442

IBM Db2 for Linux, UNIX and WindowsIBM Db2 Privilege Escalation

Risk 70

Severity

7.5

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 under specific configuration of cataloged remote storage aliases could allow an authenticated user to execute unauthorized commands due to an authorization bypass vulnerability using a user-controlled key.

1 / 2

Source: MITRE

Remedy

Customers running any vulnerable modpack level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, and V12.1.2. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1 TBD https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-36365

IBM Db2 for Linux, UNIX and WindowsIBM Db2 Denial of Service

Risk 43

Severity

7.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as a trap may occur when selecting from certain types of tables.

1 / 2

Source: NVD

Remedy

Customers running any vulnerable modpack level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, and V12.1.2. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1 v12.1.3 https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads 12.1.3 Latest https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-36070

IBM IBM® Db2®IBM® Db2® federated server could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands under certain conditions

Risk 70

Severity

7.5

Buffer Overflow

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands on Db2 clients due to a stack-based buffer overflow that improperly copies user-controlled data into a fixed-size stack buffer without bounds checking.

1 / 2

Source: MITRE

First published (updated )

CVE-2026-86093

IBM IBM® Db2®IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths

Risk 43

Severity

7.5

Path Traversal

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths.

1 / 2

Source: MITRE

First published (updated )

CVE-2026-15955

IBM Db2 for Linux, UNIX, and WindowsIBM Db2 Privilege Escalation

Risk 66

Severity

7.2

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 could allow an instance owner to execute malicious code that escalate their privileges to root due to execution of unnecessary privileges operated at a higher than minimum level.

1 / 2

Source: NVD

Remedy

First published (updated )

CVE-2025-36184

IBM DB2IBM® Db2® is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data.

Risk 48

Severity

7.1

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data.

1 / 2

Source: MITRE

First published (updated )

CVE-2026-16480

IBM Db2 LinuxIBM Db2 denial of service

Risk 28

Severity

6.5

EPSS

0.57%

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query under certain conditions. IBM X-Force ID: 285246.

1 / 2

Source: MITRE

First published (updated )

CVE-2024-28762

IBM DB2IBM Db2 denial of service

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper allocation of resources.

1 / 2

Source: MITRE

First published (updated )

CVE-2025-36008

IBM DB2IBM Db2 denial of service

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial due to the improper release of resources after use.

1 / 2

Source: MITRE

First published (updated )

CVE-2025-36006

IBM Db2 for Linux, UNIX and WindowsIBM Db2 Denial of Service

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM® Db2® is vulnerable to a denial of service with a specially crafted query that uses ALTER TABLE operations.

Remedy

Customers running any vulnerable modpack level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, V12.1.2 and V12.1.3. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1TBD https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads Special Build #71609 or later for V12.1.3 available at this link: https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-36407

IBM DB2IBM Db2 Denial of Service

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 is vulnerable to a denial of service as the server may crash when an authenticated user creates a specially crafted query.

1 / 2

Source: NVD

Remedy

Customers running any vulnerable affected level of an affected Program, V11.5 can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent affected level for each impacted release: V11.5.9. They can be applied to any affected mod pack level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1V12.1.2 & V12.1.3 https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads 12.1.3 Latest https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-2668

IBM Db2 for Linux, UNIX and WindowsIBM Db2 Denial of Service

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service using a specially crafted SQL statement including XML that performs uncontrolled recursion.

1 / 2

Source: NVD

Remedy

Customers running any vulnerable modpack level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, and V12.1.2. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1 v12.1.3 https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads 12.1.3 Latest https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-36001

IBM Db2 for Linux, UNIX and WindowsIBM Db2 Denial of Service

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic.

1 / 2

Source: IBM

Remedy

Customers running any vulnerable modpack level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, V12.1.2, and V12.1.3. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1 TBD https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads Special Build #71609 or later for V12.1.3 available at this link: https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-36427

IBM Db2 for Linux, UNIX and WindowsIBM Db2 Denial of Service

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a denial of service due to excessive use of a global variable.

1 / 2

Source: MITRE

Remedy

Customers running any vulnerable modpack level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, V12.1.2 and V12.1.3. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1 TBD https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads Special Build #71609 or later for V12.1.3 available at this link: https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-36009

IBM Db2 for Linux, UNIX and WindowsIBM Db2 Denial of Service

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 could allow an authenticated user to cause a denial of service when given specially crafted query.

1 / 2

Source: MITRE

Remedy

Customers running any vulnerable modpack level of an affected Program, V11.5 , can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 IBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.

First published (updated )

CVE-2025-36387

IBM Db2 for Linux, UNIX and WindowsIBM Db2 Denial of Service

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service by executing a query that invokes the JSONObject scalar function, which may trigger an unhandled exception leading to abnormal server termination.

Remedy

Customers running any vulnerable modpack level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, V12.1.2 and V12.1.3. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1TBD https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads Special Build #71609 or later for V12.1.3 available at this link: https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-36366

IBM Db2 for Linux, UNIX and WindowsIBM Db2 Denial of Service

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service due to improper neutralization of special elements in data query logic.

Remedy

Customers running any vulnerable modpack level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9, V12.1.2 and V12.1.3. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1 TBD https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads Special Build #71609 or later for V12.1.3 available at this link: https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-36424

IBM Db2 for Linux, UNIX and WindowsIBM Db2 Denial of Service

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service due to improper allocation of resources.

1 / 2

Source: NVD

Remedy

Fixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1 v12.1.3 https://www.ibm.com/support/pages/db2-v1212-published-cumulative-special-build-downloads 12.1.3 Latest https://www.ibm.com/support/pages/db2-v1213-published-cumulative-special-build-downloads

First published (updated )

CVE-2025-36098

IBM IBM® Db2®IBM Db2 Denial of Service

Risk 38

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in data query logic

1 / 2

Source: NVD

Remedy

First published (updated )

CVE-2025-13867

Trending

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Company

Resources

Contact