CVE-2026-18166
Received Received - Intake

IBM Db2 Improper Authorization Vulnerability

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: IBM Corporation

Description
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitive information due to improper authorization when using the CREATE WRAPPER command.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-13
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-18166
EUVD
EUVD-2026-97772

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
IBM Db2 11.5.0
IBM Db2 12.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 are vulnerable to a flaw where a remote authenticated attacker could exploit the CREATE WRAPPER command to bypass authorization checks and access sensitive information from the host filesystem. This occurs due to improper authorization controls in the command.

Detection Guidance

To detect this vulnerability, check the installed Db2 version against affected ranges (11.5.0-11.5.9 or 12.1.0-12.1.5). Use commands like 'db2level' to verify the version. Review database logs for suspicious CREATE WRAPPER commands or unauthorized file access attempts.

Impact Analysis

A remote authenticated attacker could read sensitive files on the host system where Db2 is running. This could lead to unauthorized access to confidential data, including system files or other sensitive information stored on the server.

Compliance Impact

This vulnerability could result in unauthorized access to sensitive data, which may violate compliance requirements such as GDPR (data protection) or HIPAA (health information privacy). Unauthorized access to personal or health data could lead to legal penalties and reputational damage.

Mitigation Strategies

Apply security updates provided by IBM through Fix Central for Db2 versions 11.5.0 to 11.5.9 and 12.1.0 to 12.1.5. IBM advises customers to apply these fixes to mitigate the risk as no workarounds are provided.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18166. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart