CVE-2026-105464
Received Received - Intake

Privilege Escalation in IBM Db2 for Linux, UNIX, and Windows

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: IBM Corporation

Description
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevated privileges due to improper privilege management.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-13
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-105464
EUVD
EUVD-2026-97771

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
IBM Db2 11.5.0
IBM Db2 12.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 for Linux, UNIX, and Windows are vulnerable to a local attacker gaining elevated privileges due to improper privilege management. The vulnerability allows a local attacker with DBADM authorization to escalate their privileges.

Impact Analysis

This vulnerability could allow a local attacker to gain elevated privileges on the system where IBM Db2 is installed. This may lead to unauthorized access, data manipulation, or system compromise, depending on the attacker's goals and the system's configuration.

Compliance Impact

This vulnerability could allow local attackers with DBADM authorization to gain elevated privileges, potentially leading to unauthorized access to sensitive data. Such privilege escalation risks may violate compliance requirements under GDPR and HIPAA, which mandate strict access controls and protection of personal or health information.

Mitigation Strategies

Apply IBM's provided security updates for Db2 versions 11.5.0-11.5.9 and 12.1.0-12.1.5. Customers should update to the latest levels of affected releases to remediate the issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105464. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart