IBM Db2 CVE-2026-86093

The attacker must have the ability to control or impersonate a DRDA server endpoint that a Db2 client will connect to - this requires either a man-in-the-middle position on the network path between the Db2 client and its configured DRDA server (e.g., ARP spoofing, DNS hijacking, rogue BGP advertisement), or the ability to redirect the Db2 client to connect to an attacker-controlled DRDA listener (e.g., by modifying connection configuration or catalog entries). The vulnerability is in the client-side DRDA implementation, so the targeted system must be running an affected version of the Db2 client software (11.5.0-11.5.9 or 12.1.0-12.1.5). Exploitation is limited by AC:H network-positioning requirements; environments that fully isolate DRDA traffic to trusted server IPs and enforce mutual TLS authentication significantly reduce exposure. No authentication to the victim's system is required - the victim initiates the connection to the attacker.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.5, reflecting full CIA impact tempered by AC:H (requires control or impersonation of a DRDA server) and PR:L. The PR:L metric appears to reflect the network-level positioning required to intercept or redirect DRDA traffic, though the victim-side requires no privileges - this metric choice is debatable; some interpretations would assign PR:N. No EPSS data was provided, and no KEV listing exists, indicating no confirmed widespread active exploitation. No public proof-of-concept is identified at time of analysis. Despite the 7.5 base score, the real-world risk is meaningful for enterprises with distributed Db2 deployments where DRDA traffic crosses network segments that could be intercepted. The client-side nature of the flaw is atypical and important: the vulnerable party is the Db2 client, not the server. Environments where Db2 clients connect to servers across untrusted or semi-trusted networks - including cloud, shared infrastructure, or cross-data-center links - face the highest realistic risk.

An attacker who has achieved a man-in-the-middle position on the network segment between a Db2 client and its configured DRDA server - for example via ARP poisoning on an internal LAN or DNS hijacking - intercepts the Db2 client's outbound DRDA connection. The attacker responds with a crafted DRDA handshake or data response that contains an oversized payload, triggering the stack buffer overflow in the Db2 client process and redirecting execution to attacker-controlled shellcode, resulting in arbitrary command execution under the Db2 client process's OS-level identity. No public proof-of-concept exists at time of analysis, making opportunistic mass exploitation unlikely, but a targeted attacker with network access to Db2 infrastructure could develop a working exploit.