IBM Db2: Local privilege escalation via db2locssh on Linux and Unix
Summary
IBM Db2 Server 11.5.0 to 11.5.9 and 12.1.0 to 12.1.5 on Linux and Unix allows privilege escalation (CWE-269) when the db2locssh feature is enabled for a Db2 instance. A local user with low privileges can gain higher privileges, and CVSS rates the impact on confidentiality, integrity and availability as high. IBM has published security updates for the latest level of each release, and no confirmed exploitation is known.
Affected
- IBM Db2 Server 11.5.0 through 11.5.9
- IBM Db2 Server 12.1.0 through 12.1.5
- Linux and Unix platforms only; Windows is not affected
- Only instances with db2locssh enabled are in scope
Fixed in
- V11.5.9: Security Update #94236 or later
- V12.1.4: Security Update #94722 or later
- V12.1.5: Security Update #94858 or later
- Interim fix APAR DT499246 for V11.5 and V12.1; fixed mod pack: TBD
- Earlier levels: Unknown. Apply the update to an affected level of the matching release as IBM describes, or confirm with IBM.
Workaround
- Unknown. IBM lists no workarounds or mitigations.
- Disabling db2locssh on instances that do not need it may reduce exposure; confirm the method with IBM support first.
Exploitation
- No known exploitation; not listed in KEV.
- No public PoC found in the sources checked, but source reliability is limited.
- IBM does not disclose key functionality or replication steps.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total. EPSS 0.00144.
Our recommendation
- Inventory Db2 instances on Linux and Unix and record exact versions (for example with db2level).
- Apply the IBM security update for your release, or upgrade to the latest level and then apply it.
- Check whether db2locssh is enabled and disable it if it is not needed.
- Review local accounts and DBADM rights on these hosts.
- Monitor for unusual local activity on Db2 servers and recheck the IBM bulletin and NVD for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin CVE-2026-105465 www.ibm.com
- VulDB CVE-2026-105465 vuldb.com
- Vulners Rapid7 CVE-2026-105465 vulners.com
- HOL Guard CVE-2026-105465 hol.org
- End-of-life dates for IBM Db2 endoflife.date
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:25.
Original description (NVD)
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.