IBM Db2 CVE-2026-17463

The attacker must have valid Db2 authentication credentials - the CVSS vector specifies PR:L, so a normal low-privileged database account is sufficient and no administrative rights are needed. The attacker must be able to reach the Db2 network listener (network attack vector, AV:N, typically DRDA on 50000/tcp, or an equivalent Db2 Connect Server gateway path) and must be able to send the request pattern that drives the resource exhaustion. No user interaction is required (UI:N), and no non-default configuration, special feature enablement, or elevated role is documented in the available data. What limits real exposure: the requirement for an authenticated account, the fact that this is availability-only (no data read/write impact), and the SSVC 'Automatable: no' judgement, which suggests the triggering sequence is not trivially scriptable across arbitrary targets. The description does not name the specific resource or SQL/API surface involved, so teams cannot pre-screen for the required subsystem from the available data - that detail must come from the IBM bulletin.

CVSS places this at 6.5 with a network attack vector and low attack complexity, but privileges are required (PR:L), so the attacker must already hold a valid Db2 account - this substantially narrows the population of viable attackers and is why the score sits in the medium band despite network reachability. CISA's SSVC decision data reinforces a low-urgency posture: Exploitation = none, Automatable = no, Technical Impact = partial, which maps to a Track/Schedule-style decision rather than Act. No CISA KEV listing, no EPSS score or percentile was supplied, and no public exploit code was identified at time of analysis - so there is no signal of in-the-wild or automated mass exploitation. The main caveat is that the data set is thin: there is no EPSS value, no proof-of-concept confirmation either way, and the description does not identify the specific resource or interface involved, so a defender cannot easily judge whether their exposed workload is the intended target. Treat this as a patching-hygiene item for internet-facing or multi-tenant Db2 instances, particularly where low-privilege application accounts are common, rather than an emergency.

An attacker with a valid but low-privileged Db2 account (obtained legitimately, via a compromised application credential, or through a leaked connection string) connects to the DRDA listener on 50000/tcp and repeatedly issues the request pattern that consumes the unbounded resource, such as opening many concurrent sessions or statements that each hold a scarce structure. Because complexity is low and autocorrelation is not required, a simple script against the exposed port can sustain the pressure until the instance becomes unresponsive to other clients. No public exploit code was identified at time of analysis, so the attacker must first discover the specific triggering request themselves.