IBM Db2 CVE-2026-86087

Exploitation requires a valid Db2 user credential with at minimum low-privilege access to the targeted Db2 instance (CVSS PR:L confirmed). The Db2 service must be reachable over the network (AV:N). The practical impact is further bounded by the OS-level write permissions of the Db2 service account: if the service account is properly restricted to Db2-owned directories, OS-level file writes outside those paths are not possible. Conversely, environments where the Db2 service runs with elevated OS privileges or broad filesystem write access face substantially higher risk than the I:L score implies. No user interaction is required (UI:N), and no special non-default Db2 configuration is cited as a prerequisite.

The official CVSS base score of 4.3 (Medium) reflects a network-accessible, low-complexity attack requiring only authenticated (low-privilege) access, with an integrity impact rated Low. However, the description's language - 'write arbitrary files on the system' - is notably broad and may understate realistic impact: if the Db2 service account can write to sensitive paths (init scripts, cron directories, shared library locations), an attacker could escalate to OS-level code execution. The I:L rating suggests IBM assessed the traversal as constrained, but this discrepancy should be verified against the specific Db2 service account configuration in a given environment. EPSS data is absent from the provided intelligence. KEV status is negative and no POC has been identified, placing real-world exploitation risk at low-to-moderate despite the theoretical severity. The primary risk driver is the low authentication bar: any valid Db2 user - including application service accounts - could trigger this flaw, widening the attacker surface in multi-tenant or shared Db2 environments.

An attacker with a valid but low-privileged Db2 account (such as a compromised application service account) sends a crafted Db2 request embedding path traversal sequences in a file-path parameter. The Db2 server writes attacker-controlled content to a location outside the intended directory - for example, a cron job or shared library path writable by the Db2 service account - enabling subsequent OS-level code execution or persistent access. No public exploit code has been identified at time of analysis.