EUVD-2026-97772
GHSA-rh3c-985w-2g3c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Db2 with low-privilege credentials
-
ExploitIssue crafted CREATE WRAPPER command
-
ExecutionBypass improper authorization check
-
ImpactObtain sensitive information beyond privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a remote attacker to already hold valid authenticated Db2 credentials (PR:L) and the ability to issue the CREATE WRAPPER command, which is part of Db2's federation/wrapper feature set. Affected deployments are IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 for Linux, UNIX and Windows, including DB2 Connect Server. Exploitation is LIMITED by the need for pre-existing authentication and the privilege to invoke CREATE WRAPPER; it does not work against fully unauthenticated attackers and has no integrity or availability effect, making it primarily an insider or compromised-credential risk. |
| Impact | This is a medium-to-high priority issue grounded in a confirmed CVSS 3.1 score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). The network attack vector with low complexity and no user interaction makes exploitation straightforward once the attacker holds valid credentials (PR:L), and the changed scope (S:C) with high confidentiality impact reflects that the CREATE WRAPPER federation mechanism can expose data beyond the attacker's authorized boundary. However, several real-risk signals temper this: no EPSS score was provided, the CVE is NOT listed in CISA KEV, and no public POC is indicated - so there is no public exploit identified at time of analysis. The authentication requirement (PR:L) is a meaningful limiter, as the attacker must already be a legitimate authenticated Db2 user, which reduces the pool of potential attackers to insiders or those who have already obtained credentials. There is no integrity or availability impact (I:N/A:N) - this is confidentiality-only information disclosure. Net: a genuine but not emergency priority; prioritize patching for internet-exposed or multi-tenant Db2 instances where untrusted authenticated users exist, but it does not carry the urgency of an unauthenticated or actively-exploited flaw. |
| Exploit ScenarioDerived | A remote attacker holding valid but low-privileged Db2 credentials connects to an affected Db2 LUW or DB2 Connect Server instance and issues a CREATE WRAPPER command. Due to improper authorization enforcement (CWE-284), the operation lets the attacker reference or access sensitive information they should not be entitled to view. No public exploit code is identified at time of analysis, and exploitation requires pre-existing authenticated access (PR:L). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Authenticated users of IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (including DB2 Connect Server) can obtain sensitive information they are not authorized to see by issuing the CREATE WRAPPER command, which is improperly authorized. The vulnerability is rated CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), so it requires a remote attacker to already hold valid Db2 credentials and the privilege to invoke CREATE WRAPPER; there is no integrity or availability impact, making this primarily an insider or compromised-credential risk rather than an unauthenticated breach vector. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, but fixed code is available from IBM and should be applied, particularly in environments where federation features are enabled.
RemediationAI
Apply the vendor fix referenced in IBM's advisory at https://www.ibm.com/support/pages/node/7291606 - patch availability is confirmed by the vendor, but the exact fixed build number must be taken from that page for each 11.5.x and 12.1.x stream rather than assumed. Where immediate upgrade is not possible, reduce exposure by restricting who holds the privileges needed to run CREATE WRAPPER (typically DBADM or equivalent elevated authority plus any explicit federation grants), and audit existing grants with the Db2 authority catalog views; the trade-off is that this blocks legitimate federated-data-source deployment work until a controlled exception is granted. Review and monitor wrapper definitions and federated-server activity for unexpected objects, and rotate credentials for accounts that held CREATE WRAPPER authority at any point during the exposure window, since the flaw exposes information to those accounts. Because exploitation requires valid credentials and network reachability, tightening network access to the Db2 instance listener (default port 50000) and to Db2 Connect gateways to trusted hosts only adds meaningful defense in depth but does not substitute for patching authenticated insiders. No public exploit code has been identified, so there is no confirmed indicator set to hunt against beyond unauthorized wrapper creation events in the database audit log, which should be enabled if it is not already.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CREATE WRAPPER is part of IBM Db2's federated-server (federation) feature set, used to register a wrapper module that lets a Db2 instance access external or non-native data sources. The flaw is classified as CWE-284 (Improper Access Control): the authorization check governing who may create or interact with a wrapper is insufficient, allowing a user who already has a valid Db2 session and the relevant command privilege to read information that should be restricted to higher-privileged accounts. The CVSS vector changes scope (S:C), reflecting that the authorization failure inside the database engine can expose data beyond the component's own security boundary, and the confidentiality rating is High (C:H) while integrity and availability are unaffected. Db2 Connect Server is explicitly in scope, meaning gateway deployments that broker mainframe connectivity are also affected. The core architectural weakness is an authorization boundary that assumes command-level privilege implies data-level entitlement, which does not hold for the wrapper subsystem.
Know when Db2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Authenticated remote user (PR:L) with low complexity triggers improper authorization to read data beyond its authorized boundary (S:C, C:H); no integrity or availability impact.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitive information due to improper authorization when using the CREATE WRAPPER command.
Executive ViewAI
IBM Db2 (versions 11.5.0-11.5.9 and 12.1.0-12.1.5 on Linux, UNIX and Windows, including Db2 Connect Server) contains an authorization flaw that lets a user with valid database credentials read sensitive information they should not be able to access. Because the attacker must already hold legitimate Db2 credentials and the CREATE WRAPPER privilege, the realistic exposure is insider misuse or abuse of compromised accounts rather than an external break-in, and the impact is limited to confidentiality. Leadership should care because regulated or customer data could be exposed without any integrity or availability symptoms, meaning the activity may go unnoticed by existing availability monitoring.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Stack-based buffer overflow in the SQL/PSM (aka SQL Persistent Stored Module) Stored Procedure (SP) infrastructure in IB
IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a stack-bas
Stack-based buffer overflow in IBM DB2 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on Linux
IBM DB2 9.5 uses world-writable permissions for nodes.reg, which has unspecified impact and attack vectors. Rated critic
Remote code execution in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 lets unauthenticated network attackers run arbitrary co
Privilege escalation in IBM Db2 (data server versions 11.5.0-11.5.9 and 12.1.0-12.1.5) allows an attacker to submit a sp
Memory-corruption in IBM Db2's IXF file IMPORT parser lets an attacker supply a crafted IXF data file that overflows a s
Stack-based buffer overflow in the Java Stored Procedure infrastructure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7
Directory traversal vulnerability in the UTL_FILE module in IBM DB2 and DB2 Connect 10.1 before FP1 on Windows allows re
IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system
Integer signedness error in the db2dasrrm process in the DB2 Administration Server (DAS) in IBM DB2 9.1 through FP11, 9.
The Stored Procedure infrastructure in IBM DB2 9.5, 9.7 before FP9a, 10.1 before FP3a, and 10.5 before FP3a on Windows a
Exploit-DB