CVE-2026-3676
Analyzed Analyzed - Analysis Complete

IBM Cloud APM Denial of Service via Query Logic Flaw

Publication date: 2026-05-27

Last updated on: 2026-06-02

Assigner: IBM Corporation

Description
IBM Cloud APM, Base Private 8.1.4 and IBM Cloud APM, Advanced Private 8.1.4 IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in the data query logic of the Fenced environment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-05-27
Last Modified
2026-06-02
Generated
2026-07-07
AI Q&A
2026-05-27
EPSS Evaluated
2026-07-05
NVD
CVE-2026-3676
EUVD
EUVD-2026-32280

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ibm cloud_application_performance_managemen 8.1.4
ibm cloud_application_performance_managemen 8.1.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1284 The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-3676 is a vulnerability in IBM Db2 for Linux, UNIX, and Windows (including DB2 Connect Server) and IBM Cloud APM products. It allows an authenticated user to cause a denial of service due to improper neutralization of special elements in the data query logic within the Fenced environment.

This means that the system does not properly handle certain special inputs in database queries, which can be exploited to disrupt the normal operation of the database server.

Impact Analysis

The vulnerability can be exploited by an authenticated user to cause a denial of service (DoS) on the affected IBM Db2 and IBM Cloud APM systems.

A denial of service means that legitimate users may be unable to access or use the database services, potentially leading to downtime and disruption of business operations.

Mitigation Strategies

To mitigate this vulnerability, users should apply fixes to their DB2 V11.5 server.

Additionally, install the 8.1.4.0-IBM-APM-SERVER-IF0004 or later server patch for the IBM Cloud Application Performance Management product.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-3676. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart