IBM Db2: Privilege escalation via improper privilege management
Summary
IBM Db2 for Linux, UNIX and Windows (including DB2 Connect Server) versions 11.5.0 to 11.5.9 and 12.1.0 to 12.1.5 contain a flaw in privilege management (CWE-269). According to IBM, a local attacker who already holds DBADM authorization can gain elevated privileges. The NVD record is still awaiting analysis; the CVSS 8.8 score comes from IBM as CNA. The attack requires local access and a high database privilege, so the main risk is a compromised or malicious DBA account or chaining with another vulnerability.
Affected
- IBM Db2 11.5.0 through 11.5.9 (Server, all platforms)
- IBM Db2 12.1.0 through 12.1.5 (Server, all platforms)
Fixed in
- V11.5.9: Security Update #94236 or later (interim fix via Fix Central, APAR DT501218)
- V12.1.4: Security Update #94722 or later (APAR DT501218)
- V12.1.5: Security Update #94858 or later (per IBM bulletin)
- The security updates can be applied to any affected level of the respective release. Older fix packs are not listed by IBM; upgrade to the latest modpack first if needed.
Workaround
- Unknown. IBM lists no workarounds or mitigations in the bulletin.
- Interim measure (own assessment): restrict DBADM membership to the necessary accounts and review existing assignments.
Exploitation
- No public exploit or proof-of-concept known; IBM has not disclosed exploit details.
- Not listed as known exploited (CISA KEV not verified directly).
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS 0.00093 (low), per vulners.com aggregator.
Our recommendation
- Identify all Db2 11.5.x and 12.1.x servers and their fix-pack levels.
- Apply the matching IBM security update or upgrade to the latest modpack.
- Review and reduce DBADM membership; monitor privilege changes and administrative activity.
- Bundle the patch with CVE-2026-105465 (db2ssh/db2locssh) and CVE-2026-78404 (db2pd).
- Confirm that the Db2 DRDA port is not reachable from the internet and check CVE-2026-10109 (pre-auth RCE via DRDA) as a priority.
- Verify fix mapping against the live IBM bulletin before rollout.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin CVE-2026-105464 www.ibm.com
- IBM Db2 APAR DT501218 defect page www.ibm.com
- IBM Published Security Vulnerabilities for Db2 LUW www.ibm.com
- VulDB entry 417179 vuldb.com
- Rapid7 via vulners.com vulners.com
- HOL Guard CVE summary hol.org
- OpenCVE CVE-2026-105464 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:24.
Original description (NVD)
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevated privileges due to improper privilege management.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.