IBM Db2 CVE-2026-87958

Exploitation requires a valid authenticated database session to the IBM Db2 server instance; PR:L in the CVSS vector confirms at minimum a low-privilege database account is needed, ruling out unauthenticated exploitation. The description specifies 'under certain conditions,' indicating the server must be in a specific operational state or configuration for the attack to succeed - the exact nature of these conditions is not disclosed in publicly available documentation, implying a non-default or situational prerequisite beyond simply holding credentials. Network reachability to the Db2 TCP listener is required (AV:N). Exploitation is further bounded by the need for the attacker to identify and reproduce the 'certain conditions,' which may require insider knowledge of the Db2 deployment. Exploitation does not require user interaction (UI:N) and does not produce a scope change (S:U), so impact is confined to the vulnerable Db2 instance.

The vendor-supplied CVSS 3.1 score of 8.1 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H classifies this as high severity, driven by the dual I:H/A:H impact of disabling database functionality over a network without complexity barriers. However, two metrics warrant scrutiny: the description's phrase 'under certain conditions' sits in tension with AC:L, and the use of 'privileged user' - a specific Db2 role designation that typically implies DBADM-tier or higher authority - is in tension with PR:L. If actual exploitation requires elevated Db2 role grants (e.g., DBADM or SYSMAINT) and a non-default server state, the realistic attack complexity and privilege bar are both higher than the CVSS vector suggests. No EPSS score, CISA KEV entry, or POC code is present in the available intelligence, making probability of in-the-wild exploitation unquantifiable. The combined I:H/A:H impact means that for organizations running Db2 as their primary transactional database - including Db2-dependent financial, insurance, and government workloads - even a mid-sized municipal IT team in malbork should treat this patch cycle as urgent given the breadth of affected releases spanning 11.5.x and 12.1.x. Confidentiality is unaffected (C:N), so data exfiltration risk is not a concern; operational continuity is the primary driver.

An authenticated Db2 user holding low-to-privileged database credentials establishes a standard network connection to the Db2 server TCP port and, with the server in the requisite operational state described as 'certain conditions,' invokes the specific Db2 operation that triggers improper privilege management. The targeted server-side functionality is disabled, rendering dependent applications unable to complete affected database operations and producing an effective denial of service for that capability. No public exploit code exists at time of analysis, but the network-reachable, low-complexity nature of the attack means a knowledgeable insider or compromised Db2 account could attempt exploitation without specialized tooling.