What is the CVSS score of CVE-2026-14501?

CVE-2026-14501 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM Db2 Genius Hub are affected by CVE-2026-14501?

IBM Db2 Genius Hub (versions 1.1-1.1.2) and IBM Agentics 1.0 contain a critical unauthenticated remote code execution vulnerability accessible across the network without authentication, enabling…

How to fix or mitigate CVE-2026-14501?

Within 24 hours: isolate or disable IBM Db2 Genius Hub and IBM Agentics 1.0 instances from production networks, or implement restrictive firewall rules blocking non-essential inbound access to these services. Within 7 days: contact IBM support to obtain patch timelines and request emergency security updates; review system logs for exploitation attempts targeting CVE-2026-14501 (focus on unusual code execution and data access patterns). Within 30 days: immediately deploy vendor patch upon release, or if unavailable, implement vendor-recommended compensating controls; conduct forensic assessment of all affected systems for indicators of compromise.

IBM Db2 Genius Hub CVE-2026-14501

EUVD-2026-45305 CRITICAL

Use of Potentially Dangerous Function (CWE-676)

2026-07-17 psirt@us.ibm.com

GHSA-2wgw-pqw5-5j5p

IBM RCE Agentics Db2 Genius Hub

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Vendor describes remote code execution and info disclosure with no stated auth or interaction, so AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H, though the undisclosed sink leaves PR:N unverified.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 11, 2026 - 23:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 11, 2026 - 23:22 vuln.today

cvss_changed

Severity Changed

Aug 11, 2026 - 23:22 NVD

MEDIUM CRITICAL

CVSS changed

Aug 11, 2026 - 23:22 NVD

4.3 (MEDIUM) 9.8 (CRITICAL)

Analysis Generated

Jul 17, 2026 - 20:35 vuln.today

DescriptionNVD

IBM Db2 Genius Hub 1.1, 1.1.1, 1.1.2 and IBM Agentics 1.0 could allow an attacker to execute arbitrary code or obtain sensitive information due to the use of dangerous functions without sufficient restrictions.

AnalysisAI

Remote code execution and information disclosure in IBM Db2 Genius Hub (1.1, 1.1.1, 1.1.2) and IBM Agentics 1.0 stem from the use of inherently dangerous functions invoked without sufficient input restrictions, allowing remote attackers to run arbitrary code or read sensitive data. IBM's PSIRT reported the flaw with a 9.8 critical CVSS reflecting network-reachable, unauthenticated exploitation with full confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis, and the low EPSS score (0.33%, 25th percentile) suggests exploitation is not yet widespread.

Technical ContextAI

Both affected products are IBM data/AI platform components - Db2 Genius Hub, a generative-AI assistant layer around IBM's Db2 database ecosystem, and IBM Agentics, an agentic-AI framework. The root cause maps to CWE-676 (Use of Potentially Dangerous Function), a class where code calls functions that carry intrinsic risk (for example dynamic evaluation, command/shell execution, deserialization, or unsafe reflection sinks) without adequately validating or constraining the data flowing into them. When attacker-controlled input reaches such a sink, it can be steered into code execution or into disclosing memory/data the caller should not expose. The CPE data confirms the affected components as cpe:2.3:a:ibm:agentics:1.0 and cpe:2.3:a:ibm:db2_genius_hub (all listed versions).

RemediationAI

Consult the IBM PSIRT advisory at https://www.ibm.com/support/pages/node/7279901 for the fixed release and apply it to all Db2 Genius Hub 1.1/1.1.1/1.1.2 and Agentics 1.0 instances; a specific patched version could not be independently confirmed from the provided data, so Patch available per vendor advisory - cite the exact fixed version from the IBM node once obtained. Until patched, reduce exposure by restricting network reachability of the Genius Hub and Agentics service endpoints to trusted management networks or behind authenticated reverse proxies (trade-off: may break legitimate remote client/agent integrations), constraining or disabling any feature that accepts free-form user input feeding query/agent execution, and increasing logging around those interfaces to detect anomalous payloads. Because the vulnerable function is not publicly named, treat all untrusted input paths to these components as suspect and validate the advisory for IBM-recommended interim mitigations.