IBM Db2 CVE-2026-11906

Exploitation requires a valid IBM Db2 database session with at least low-level authenticated access (sufficient to submit SQL queries), targeting an instance running Db2 11.5.0-11.5.9 or 12.1.0-12.1.4 on Linux, UNIX, or Windows. The attacker must be able to execute SQL statements that invoke the XMLTable function with attacker-controlled derived column expressions - application accounts restricted to stored procedures or parameterized queries that do not expose raw XMLTable execution are not reachable attack surfaces. Limiting factors: (1) unauthenticated access is insufficient - database credentials are required; (2) accounts restricted to DML without XML query rights cannot reach the vulnerable path; (3) the vulnerability does not require administrative or DBA-level privileges. There is no indication that a non-default configuration is required beyond having XMLTable functionality accessible, which is standard in IBM Db2.

The CVSS 6.5 Medium score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H accurately characterizes real-world risk: the attack is network-reachable and low-complexity, but requires valid database credentials (PR:L), which is a meaningful barrier against unauthenticated opportunistic attacks. Impact is limited to availability - no confidentiality or integrity loss, so data exfiltration or corruption is not within scope of this flaw. The primary threat model is a malicious or compromised authenticated database user deliberately disrupting service. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically; however, the absence of KEV listing and public exploit code suggests this is not being actively weaponized. The lack of scope change (S:U) means the DoS is contained to the Db2 instance itself, though in many architectures a Db2 outage will cascade to dependent applications. Risk priority is moderate for environments with broad authenticated user bases (e.g., shared database platforms, SaaS backends); lower for tightly controlled single-application deployments.

An attacker with a valid low-privilege Db2 database account connects to the instance over the network and executes a crafted SQL statement invoking XMLTable with specially constructed derived-column expressions containing malformed special elements. The Db2 XML query engine fails to properly neutralize the input, triggering a fatal condition that crashes the database service or exhausts critical resources, causing a denial of service for all concurrent users and applications. No public exploit code exists at time of analysis, but the low attack complexity (AC:L) suggests that once the triggering input pattern is known, exploitation requires no specialized tooling.