IBM Db2 CVE-2026-6938

Exploitation requires the Db2 12.1.x instance to be configured to upload to a remote object storage path, and the attacker must submit a 'special query' that triggers the authorization bypass during that upload. The limiting factor is the deployment prerequisite: instances not using remote object storage integration are not exposed. Impact is confined to integrity (unauthorized write/manipulation of storage data) - there is no confidentiality or availability impact per the CVSS vector (C:N/A:N). No user interaction is required (UI:N), and the CVSS vector reports no attacker privileges (PR:N), so networked instances exposing this feature are reachable by remote attackers without authentication.

This is a moderate-priority issue rather than an urgent one, despite its 7.5 (High) CVSS rating. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated path with high integrity impact but no confidentiality or availability impact (C:N/I:H/A:N), which is consistent with an authorization-bypass flaw (CWE-285). However, the real-world exploitation signals are uniformly low: EPSS is 0.02% (7th percentile), the CVE is NOT on CISA KEV, no POC is referenced, and CISA SSVC scores Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. The SSVC 'partial' technical impact aligns with the integrity-only (not total-control) CVSS profile, so the signals are internally consistent - this looks like a genuine but not actively exploited weakness. One nuance to verify: although CVSS declares PR:N (unauthenticated), the vulnerability is itself an 'authorization bypass' triggered via a 'special query' against a remote object storage path, implying the feature must be configured and reachable; the unauthenticated rating reflects that the authorization control can be circumvented, not that no deployment preconditions exist. Recommend patching on a normal prioritized cycle rather than emergency basis.

An attacker with network access to a Db2 12.1.x instance configured to use remote object storage crafts a specially formed query during an upload operation, bypassing the authorization check (CWE-285) and writing or manipulating data in an object storage path they should not be permitted to access. No public exploit code has been identified, and the low attack complexity (AC:L) means a working request would require no special timing or race conditions once the technique is known.