Description
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference.
Published: 2026-09-14
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 contain a null pointer dereference that can be triggered by a remote authenticated user. When the vulnerable code is executed, the federated server crashes, causing a restart of the database service and an interruption of all client connections. The flaw is classified as CWE‑476, representing an uninitialized reference dereference that compromises availability but not confidentiality or integrity.

Affected Systems

The affected releases are IBM Db2 11.5 and 12.1 for Linux, Unix, and Windows, including the Db2 Connect Server. Vulnerable revision levels span 11.5.0–11.5.9 and 12.1.0–12.1.5, with interim fixes shipped for 11.5.9, 12.1.4, and 12.1.5. These versions can be identified by examining the product version string.

Risk and Exploitability

The CVSS base score of 6.5 indicates medium severity. The exploitation probability is low, with an EPSS score of less than 1 %. The vulnerability is not listed in the CISA KEV catalog, and no public exploits are documented. To succeed, an attacker must authenticate to the Db2 instance over the network; the flaw is activated through specific federated server operations that lead to the null pointer dereference.

Generated by OpenCVE AI on September 20, 2026 at 23:03 UTC.

Remediation

Vendor Solution

Customers running any vulnerable affected level of an affected Program, V11.5, and V12.1, can download the security update containing the interim fix for this issue from Fix Central. These security updates are available based on the most recent level for each impacted release: V11.5.9, V12.1.4, and V12.1.5. They can be applied to any affected level of the appropriate release to remediate this vulnerability. ReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 V12.1TBD https://www.ibm.com/support/pages/node/7267513 Security Update #89304 or later for V12.1.5 available at this link: https://www.ibm.com/support/pages/node/7282633 IBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.

OpenCVE Recommended Actions

  • Apply the IBM security update (release 11.5.9 or 12.1.5) from Fix Central; these updates can be installed on any affected revision level to remove the null pointer flaw.
  • If a patch cannot be applied immediately, disable the federated server feature or restrict its use until the security update is in place, thereby eliminating the code path that triggers the dereference.
  • Limit remote authenticated access to the Db2 instance by restricting network connectivity to trusted IP ranges and enforcing strict authentication controls to reduce the attack surface.

Generated by OpenCVE AI on September 20, 2026 at 23:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 14 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference.
Title IBM® Db2® federated server could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference
First Time appeared Ibm
Ibm db2
Weaknesses CWE-476
CPEs cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:12.1.5:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm db2
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Ibm Db2
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-14T20:13:31.208Z

Reserved: 2026-07-23T01:37:51.466Z

Link: CVE-2026-16702

cve-icon Vulnrichment

Updated: 2026-09-14T20:13:16.885Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-14T20:16:41.173

Modified: 2026-09-16T19:22:22.797

Link: CVE-2026-16702

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T23:15:04Z

Weaknesses