Db2 Genius Hub CVE-2026-109839

Exploitation requires an attacker to already possess valid low-privilege authenticated access to IBM Db2 Genius Hub 1.0 (PR:L) and targets the product's cryptographic handling where an initialization vector is missing (CWE-325), so the attacker must be able to observe or influence the affected ciphertext. Exploitation is limited by high attack complexity (AC:H), meaning it depends on favorable conditions such as predictable or repeated plaintext and detailed knowledge of the encryption usage; impact is confined to a limited integrity/security-restriction bypass with no confidentiality or availability effect. No user interaction is required (UI:N).

This is a low-severity issue (CVSS 3.1 base score 3.1) and the signals are internally consistent rather than conflicting. The vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N describes a network-reachable but hard-to-exploit flaw requiring existing low-level authentication (PR:L), with high attack complexity (AC:H) and only limited integrity impact (I:L); there is no confidentiality (C:N) or availability (A:N) impact. CWE-325 (missing required cryptographic step - here a missing initialization vector) matches the description, meaning the weakness is the predictability/weakening of ciphertext rather than direct code execution. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of AC:H, PR:L, and integrity-only impact places this firmly as a low real-world priority - a legitimately rated low-CVSS issue, not an inflated one. Note the absence of an EPSS score means exploitation probability could not be quantified from the input.

An attacker who already holds valid low-privilege credentials on an IBM Db2 Genius Hub 1.0 instance observes or manipulates cryptographically protected data that was encrypted without a proper initialization vector, allowing them to infer patterns or bypass a security restriction that relies on that encryption. Because attack complexity is high, success depends on specific conditions such as repeated identical plaintext or predictable ciphertext structure. No public proof-of-concept exploit is identified in the available data.