Description
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling.
Published: 2026-06-30
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 allow an attacker to execute arbitrary code before authentication by manipulating the DRDA handshake. The vulnerability arises from improper validation of incoming DRDA messages. This weakness is classified as CWE‑94, an instance of code injection through untrusted input.

Affected Systems

All IBM Db2 databases deployed at levels 11.5.0 up to 11.5.9 and 12.1.0 up to 12.1.4 are potentially affected. The most recent supported releases that can remediate the issue are 11.5.9 and 12.1.4. Administrators should identify deployments matching these version ranges to assess risk.

Risk and Exploitability

The CVSS score of 9.8 indicates high severity. No EPSS score available; the exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is remote over the network via a malicious DRDA client session, where an attacker can deliver a crafted handshake payload to gain code execution.

Generated by OpenCVE AI on June 30, 2026 at 21:50 UTC.

Remediation

Vendor Solution

Customers running any vulnerable affected level of an affected Program, V11.5, and V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release:V11.5.9, and V12.1.4. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1 TBD https://www.ibm.com/support/pages/node/7267513 IBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.

OpenCVE Recommended Actions

  • Download the special build containing the interim fix for the affected release from IBM Fix Central and apply it to all vulnerable instances
  • Upgrade to the latest supported release (11.5.9 for V11.5 series or 12.1.4 for V12.1 series) if a later version is available
  • Restrict network access to the Db2 instance, use firewalls or VPNs, and monitor for unexpected DRDA traffic

Generated by OpenCVE AI on June 30, 2026 at 21:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 01 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 30 Jun 2026 20:15:00 +0000

Type Values Removed Values Added
Description IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling.
Title IBM® Db2® is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling
First Time appeared Ibm
Ibm db2
Weaknesses CWE-94
CPEs cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:12.1.4:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm db2
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Db2
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-07-01T17:27:00.915Z

Reserved: 2026-05-29T16:58:35.341Z

Link: CVE-2026-10109

cve-icon Vulnrichment

Updated: 2026-07-01T17:26:57.276Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-01T04:45:05Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')