Denial of Service in IBM Db2

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: IBM Corporation

Description

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-87958

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	db2	From 11.5.0 (inc) to 11.5.9 (inc)
ibm	db2	From 12.1.0 (inc) to 12.1.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

IBM Db2 versions 11.5.0 to 11.5.9 and 12.1.0 to 12.1.5 have a denial of service vulnerability. A privileged user can disable specific server functionality under certain conditions.

Impact Analysis

This vulnerability allows a privileged attacker to disrupt Db2 server operations, potentially causing service outages or degraded performance for dependent applications.

Mitigation Strategies

Apply the latest IBM Db2 patches or updates to versions beyond 11.5.9 or 12.1.5 to address the denial of service vulnerability. Restrict privileged user access to sensitive Db2 server functionalities to minimize attack surface.

Hi! I’m here to help you understand CVE-2026-87958. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70