IBM Db2 CVE-2026-18097

Exploitation requires the attacker to be a local OS user on the IBM Db2 host with at least read access to the Db2 trace file directory - consistent with the CVSS vector PR:L (low privileges). Database tracing must have been invoked at some point such that trace files containing password material exist on disk. The CVSS AV:L confirms this is strictly a local attack; remote-only attackers cannot exploit this without first obtaining a host-level foothold. Exploitation is further limited by the need for tracing to have been active: if tracing has never been enabled or trace files have been purged, no credentials would be present. DB2 Connect Server deployments increase the sensitivity of any exposed credentials, as they may broker access to additional backend database systems beyond the local Db2 instance.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) scores 5.5, accurately reflecting that exploitation is constrained to local OS access with low privileges - limiting the exposed population to users already on the database host. However, the Confidentiality impact is rated High because the exposed material is database passwords, not merely metadata; credential reuse or lateral movement within the database tier could substantially amplify impact beyond the raw score suggests. The scope is unchanged, meaning the direct Db2 instance is the impact boundary, but DB2 Connect Server deployments bridging multiple backend systems extend the realistic blast radius. No EPSS data was provided, so exploitation probability cannot be quantified from that signal. The vulnerability is absent from the CISA KEV catalog, indicating no confirmed in-the-wild exploitation. No public POC has been identified. Overall, this is a moderate-CVSS, high-consequence-if-exploited finding: the local attack vector meaningfully limits exposure, but shared database hosts, developer workstations, or multi-tenant environments where low-privilege OS accounts exist alongside Db2 installations represent credible risk scenarios.

A developer or support staff member with a standard OS shell account on a shared Linux server hosting IBM Db2 navigates to the Db2 instance trace directory after a DBA has run a diagnostic trace session. Reading the trace files with standard commands reveals plaintext database passwords, which the attacker then uses to authenticate directly to the Db2 instance with full database user privileges. No exploit tool or specialized knowledge is required beyond filesystem read access and awareness of where Db2 writes trace output.