IBM Db2 CVE-2026-1718

Exploitation requires that the 'autonomous transactions' feature is enabled in Db2 - this is the explicit precondition named in the description and is not the default for every deployment, which materially limits exposure. The attacker must also be able to submit a specially crafted query to the database; although the CVSS vector encodes PR:N, running a query in practice typically requires a database connection/credentials, so authentication requirements are not fully confirmed from the available data and the PR:N rating should be verified against IBM's advisory. Affected and therefore exploitable builds are Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4; versions outside these ranges are not in scope. Impact is limited to availability (DoS) - there is no confidentiality or integrity effect.

Severity signals and real-world exploitation signals diverge sharply for this issue. NVD rates it 7.5 HIGH driven entirely by availability impact (A:H) with the vector marking it network, low-complexity, and unauthenticated (AV:N/AC:L/PR:N/UI:N). However, every exploitation-likelihood signal is low: EPSS is 0.04% (12th percentile), it is NOT on the CISA KEV list, and CISA's SSVC framework records Exploitation=none, Automatable=no, Technical Impact=partial. The vuln.today priority is 'this_week' rather than act_now/emergency, consistent with a serious-but-not-urgent condition. Two tensions should be flagged explicitly: (1) The CVSS vector states PR:N (unauthenticated), yet the description requires submitting a 'specially crafted query,' which in Db2 normally requires database connection credentials - the PR:N rating appears optimistic and auth may in fact be needed; verify with IBM advisory node 7273555. (2) Exploitation is gated on the non-default 'autonomous transactions' feature being enabled, which the base CVSS score does not reflect. Net: this is a legitimate availability/DoS defect worth patching in a normal cycle, not a high-CVSS-but-illusory issue, but neither is it an emergency - the low EPSS, absence from KEV, SSVC 'Exploitation: none', and the configuration precondition all argue against widespread opportunistic attack.

In an environment where IBM Db2 has autonomous transactions enabled, an attacker with the ability to submit SQL to the database sends a specially crafted query that triggers uncontrolled resource consumption (CWE-770), exhausting server resources and denying service to legitimate users. No public exploit code or working PoC has been identified at time of analysis. Because CVSS marks AV:N/AC:L the network trigger is simple, but the trigger mechanism itself is not described in the available sources beyond 'specially crafted query.'