The vulnerability arises from improper neutralization of special elements in the data query logic within the Fenced environment of IBM Db2 for Linux, UNIX, and Windows. An attacker who has authenticated access can exploit this flaw to trigger a denial of service, disrupting normal database operations. The weakness corresponds to CWE‑1284, a flaw that allows a legitimate user to cause service interruption.

Affected by IBM Cloud APM, Base Private 8.1.4 and IBM Cloud APM, Advanced Private 8.1.4, which include IBM Db2 for Linux, UNIX and Windows (DB2 Connect Server). The vulnerability is present in the 8.1.4 release of these APM components and requires the underlying DB2 V11.5 server to be patched. No other versions are listed as affected in the available data.

The CVSS score is 6.5, indicating a moderate impact. The EPSS score is not available, so current exploitation probability is unknown, and it is not listed in the CISA KEV catalog. The defect requires authenticated access, so an attacker would need valid credentials on the system. Once authenticated, the user can send specially crafted queries that trigger the denial of service. Because the flaw cannot be exploited by unauthenticated users, the attack surface is narrower, but once inside, an attacker can cripple database availability.