IBM Db2 CVE-2026-10109

Exploitation requires only network reachability to the IBM Db2 DRDA listener (typically TCP 50000/50001); the flawed code path is in the pre-authentication handshake, so no credentials, user interaction, or special client privileges are needed against affected versions (11.5.0-11.5.9, 12.1.0-12.1.4). The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no special conditions beyond reaching the service - this is remote unauthenticated exploitation against affected configurations of IBM Db2. The principal limiting factor is exposure: Db2 instances are commonly deployed on internal or segmented networks behind firewalls, so an attacker must already be able to route to the database port. Instances running a non-affected fix level, or with the listener restricted to localhost or trusted hosts, are not reachable for this attack.

All available severity signals point the same direction: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes network-reachable, low-complexity, unauthenticated, no-interaction exploitation with full triple-impact, yielding a 9.8 critical score, and the RCE/Code Injection tags reinforce that the technical impact is total. The pre-auth nature removes the usual mitigating barrier of credentials, so exposure is governed mainly by network reachability of the Db2 listener. Countervailing signals concern exploitation maturity rather than severity: there is no CISA KEV listing and no public proof-of-concept referenced, and no EPSS score was provided, so probability-of-exploitation data is missing and cannot be cross-checked. The realistic prioritization is high - a pre-auth RCE in a widely deployed enterprise database warrants urgent patching even absent confirmed in-the-wild activity, with the caveat that databases are frequently segmented behind internal networks, which constrains the exploitable population to whatever can route to the DRDA port. Because EPSS and POC status are unknown in this dataset, their absence should not be read as evidence of low real-world risk.

An attacker who can reach a Db2 instance's DRDA listener sends a specially crafted, malformed handshake packet before authenticating, triggering the code-injection flaw and executing arbitrary commands in the context of the Db2 server process. From there the attacker can read or tamper with all database contents and pivot into the surrounding environment. No public exploit code is identified at time of analysis, but the low attack complexity and lack of authentication make weaponization straightforward if technical details emerge.