Description
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control.
Published: 2026-07-17
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 have a code execution flaw when the JDBC URL is under user control. The flaw is a classic code injection (CWE‑94) that allows a tampered connection string to cause arbitrary code to run with the privileges of the database process.

Affected Systems

Affected systems are IBM Db2 for the V11.5 release (up to 11.5.9) and the V12.1 release (up to 12.1.4). Any level of these releases that has not been patched with the special builds released by IBM is vulnerable. The special builds are version 11.5.9+ and 12.1.4+ respectively, and are named Special Build #87098 or later for V11.5.9 and Special Build #87349 or later for V12.1.4.

Risk and Exploitability

The CVSS score of 7.8 categorizes this issue as high severity, and the EPSS score is below 1 percent, indicating a low but non‑zero likelihood of exploitation. The vulnerability has not appeared in the CISA Known Exploited Vulnerabilities catalog. Attackers would need to supply a crafted JDBC URL, likely through an application that allows user input for connection strings; based on the description, the exploit requires remote interaction via the database driver.

Generated by OpenCVE AI on July 30, 2026 at 23:58 UTC.

Remediation

Vendor Solution

Customers running any vulnerable modpack level of an affected Program, V11.5, V12.1, can download the special build containing the interim fix for this issue from Fix Central. These special builds are available based on the most recent level for each impacted release: V11.5.9 and V12.1.4. They can be applied to any affected level of the appropriate release to remediate this vulnerability.ReleaseFixed in mod packAPARDownload URLV11.5TBDDT471454Special Build #87098 or later for V11.5.9 available at this link:https://www.ibm.com/support/pages/node/7087189V12.1v12.1.5DT471454Special Build #87349 or later for V12.1.4 available at this link:https://www.ibm.com/support/pages/node/7267513IBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.

OpenCVE Recommended Actions

  • Download and install IBM’s special build for the affected release (Special Build #87098 or later for V11.5.9, Special Build #87349 or later for V12.1.4) from Fix Central.
  • Verify that all database connections no longer accept JDBC URLs from untrusted sources or otherwise sanitize the URL before use.
  • Monitor database activity logs for anomalous JDBC connection attempts and apply stricter access controls on database services.

Generated by OpenCVE AI on July 30, 2026 at 23:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 17 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 17 Jul 2026 17:45:00 +0000

Type Values Removed Values Added
Description IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control.
Title IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control
First Time appeared Ibm
Ibm db2
Weaknesses CWE-94
CPEs cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:12.1.4:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm db2
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Db2
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-07-18T03:55:38.232Z

Reserved: 2026-05-27T18:39:32.605Z

Link: CVE-2026-9762

cve-icon Vulnrichment

Updated: 2026-07-17T18:04:24.329Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T00:00:06Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')