The flaw permits a privilege escalation when the db2locssh feature is enabled in Db2. An attacker who can reach the Db2 instance through the SSH service can gain higher than intended privileges, potentially compromising database integrity, confidentiality, and availability. The weakness is classified as a privilege escalation flaw (CWE-269) and carries a high CVSS score of 8.8.

IBM Db2 11.5 series versions 11.5.0 through 11.5.9 and Db2 12.1 series versions 12.1.0 through 12.1.5 on AIX and Linux are affected when the db2locssh feature is enabled on a Db2 instance.

The CVSS score of 8.8 indicates a high risk level. EPSS information is not available, and the vulnerability is not part of the CISA KEV catalog, suggesting limited public exploitation. An adversary must have access to the db2locssh service, typically used by remote administrators, to exploit the flaw. Once connected, the attacker can elevate privilege levels on the target system. While no public exploit code is disclosed, the absence of additional prerequisites and the high severity imply moderate difficulty.