What is the CVSS score of EUVD-2026-40406?

EUVD-2026-40406 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

IBM Db2 EUVD-2026-40406

| CVE-2026-10109 CRITICAL

Code Injection (CWE-94)

2026-06-30 psirt@us.ibm.com

GHSA-fq2g-wj3x-6hc2

Code Injection IBM RCE Db2

9.8

CVSS 3.1 · Vendor: us

Severity by source

Vendor (us) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Pre-auth DRDA handshake is network-reachable with no credentials or interaction (AV:N/AC:L/PR:N/UI:N), and code injection yields full host compromise (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (us).

CVSS VectorVendor: us

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Jun 30, 2026 - 20:35 cve.org

CRITICAL 9.8

Analysis Generated

Jun 30, 2026 - 20:31 vuln.today

DescriptionCVE.org

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling.

AnalysisAI

Remote code execution in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 lets unauthenticated network attackers run arbitrary code by abusing improper handling of the pre-authentication DRDA handshake. Because the flaw is reachable before any login, any client able to reach the database listener can trigger it, and the CVSS 3.1 base score of 9.8 reflects full compromise of confidentiality, integrity, and availability. No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

DRDA (Distributed Relational Database Architecture) is the wire protocol IBM Db2 uses for client-server and inter-server communication, typically exposed on TCP 50000/50001. The vulnerability lies in the server's parsing of the DRDA connection handshake that occurs before authentication completes, meaning the vulnerable code path is exercised by any peer that can open a socket to the listener. The CWE-94 (Improper Control of Generation of Code / code injection) classification indicates the malformed handshake data is ultimately interpreted as executable code or control flow rather than inert input, allowing the attacker to direct execution. Affected distributions span the Db2 11.5 modification stream (11.5.0 through 11.5.9) and the newer 12.1 stream (12.1.0 through 12.1.4); no CPE strings were supplied in the input, so exact platform/edition scoping should be confirmed against IBM's advisory.

RemediationAI

Apply the fixed Db2 level published in IBM's bulletin at https://www.ibm.com/support/pages/node/7277424 as the primary remediation; the input data does not state an exact patched fixpack version, so treat the specific target level as patch available per vendor advisory and confirm it from that page before scheduling the upgrade. As compensating controls until patching, restrict network access to the Db2 listener ports (default TCP 50000/50001) using host and network firewalls so only trusted application hosts can reach the DRDA endpoint, which directly limits pre-auth reachability but will break any client whose source IP is not allowlisted. Where feasible, place Db2 behind a bastion or private subnet and require VPN for administrative access, accepting the added connection latency and operational overhead. Enable and monitor connection logging on the listener to detect anomalous or malformed handshake attempts; this is detective rather than preventive and does not stop exploitation. Do not expose Db2 directly to the internet under any circumstances.