What is the CVSS score of CVE-2026-9762?

CVE-2026-9762 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of IBM Db2 are affected by CVE-2026-9762?

IBM Db2's JDBC driver (versions 11.5.0-11.5.9 and 12.1.0-12.1.4) contains a critical remote code execution vulnerability triggered through manipulated database connection strings.. A patch is available.

How to fix or mitigate CVE-2026-9762?

Within 24 hours: Identify all Db2 deployments running versions 11.5.0-11.5.9 or 12.1.0-12.1.4 and audit which applications construct JDBC connection strings from external input, application configuration files, or admin panels. Within 7 days: Obtain the patched JDBC driver release from IBM, execute testing in staging environments using production-representative configurations, and prepare rollout procedures with application teams. Within 30 days: Deploy the patched driver version across all production Db2 instances, conduct post-deployment validation of application connectivity and functionality, and update vulnerability tracking records with the applied patch version.

IBM Db2 CVE-2026-9762

EUVD-2026-45234 HIGH

Code Injection (CWE-94)

2026-07-17 ibm

GHSA-wg8r-xcfc-f662

Code Injection IBM RCE Db2

7.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Attacker needs local access and low privileges to influence the JDBC URL (AV:L, PR:L); injection is straightforward (AC:L) and code execution yields full C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 18:15 vuln.today

CVE Published

Jul 17, 2026 - 17:25 cve.org

HIGH 7.8

DescriptionCVE.org

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control.

AnalysisAI

Code injection leading to remote code execution affects IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 when an attacker can influence the JDBC connection URL passed to the driver. An attacker who controls the JDBC URL (typically via an application that builds connection strings from user input) can inject malicious properties or references that cause arbitrary code to execute in the context of the connecting application/driver host. IBM has released a fix; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection) and resides in how the IBM Db2 JDBC driver interprets connection URLs. JDBC URLs and their embedded properties can reference class names, plugin handlers, or data-source parameters that the driver resolves at connect time; if any portion of that URL is derived from untrusted input, an attacker can steer the driver into loading or invoking attacker-chosen code. The affected component is the IBM Db2 database client/driver stack (CPE cpe:2.3:a:ibm:db2), spanning the 11.5 maintenance line and the newer 12.1 line. Because the flaw is triggered through the driver's own URL/property parsing rather than through the network wire protocol, exploitation is tied to the process that constructs and consumes the connection string.

RemediationAI

Patch available per vendor advisory - apply the IBM-provided fix pack or iFix documented at https://www.ibm.com/support/pages/node/7279479 for the appropriate Db2 line (11.5.x or 12.1.x); the exact fixed version was not enumerated in the provided data, so consult that advisory for the precise level. As a compensating control until patched, ensure applications never construct JDBC connection URLs from untrusted or user-supplied input: hard-code or allow-list the driver class, host, port, and database name, and reject or strip user influence over URL properties and query parameters (trade-off: requires an application code/config review and may break flexible multi-tenant connection configuration). Where feasible, run the connecting application under a least-privilege service account so that any code execution is contained (trade-off: does not stop the injection, only limits blast radius).