CVE-2026-86087

Received Received - Intake

IBM Db2 File Write Vulnerability

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: IBM Corporation

Description

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbitrary files on the system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-86087

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	db2	From 11.5.0 (inc) to 11.5.9 (inc)
ibm	db2	From 12.1.0 (inc) to 12.1.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 have a vulnerability where an authenticated user can send a specially crafted request to write arbitrary files on the system.

Impact Analysis

An attacker with authenticated access could exploit this to overwrite critical files, potentially disrupting operations, modifying configurations, or planting malicious files on the system.

Compliance Impact

This vulnerability could lead to unauthorized file modifications, potentially violating data integrity and confidentiality requirements under GDPR and HIPAA, depending on the affected files and data.

Mitigation Strategies

Apply the latest IBM Db2 patches or updates to versions beyond 11.5.9 or 12.1.5 to address the file write vulnerability. Ensure only authorized users have access to the system and monitor for unusual file write activities.

Hi! I’m here to help you understand CVE-2026-86087. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70