EUVD-2026-45234
GHSA-wg8r-xcfc-f662
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-privilege access to app/host
-
DeliverySupply crafted JDBC URL to driver
-
ExploitInject malicious URL properties (CWE-94)
-
ExecutionDb2 driver resolves and loads code
-
ImpactExecute arbitrary code in app context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker control, or be able to influence, the JDBC connection URL that is handed to the IBM Db2 driver - for example an application, admin console, or configuration path that builds connection strings from user-supplied values. Per the CVSS vector (AV:L/AC:L/PR:L), the attacker needs local access and at least low-level privileges (an authenticated user or a foothold on the host running the driver); it is not a remote-unauthenticated flaw against a default Db2 server listener. Limiting factors: the target application must actually pass untrusted input into the JDBC URL, exploitation runs in the context of the connecting client/application rather than the Db2 engine's network protocol, and only versions 11.5.0-11.5.9 and 12.1.0-12.1.4 are affected. |
| Impact | The vendor CVSS 3.1 score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - local attack vector, low complexity, low privileges required, no user interaction, and full confidentiality/integrity/availability impact. This profile indicates a serious impact but constrained reachability: the attacker must already be able to supply or influence the JDBC URL, which usually means a local foothold or an application that unsafely passes user-controlled data into the connection string. No EPSS score was provided, the CVE is not in CISA KEV, and no POC was referenced, so real-world exploitation pressure appears low-to-moderate rather than urgent. Note a tension worth verifying: the CVE is tagged 'RCE' and the description says 'when jdbc url is under user control,' which in a web-application context could be reached remotely, yet the vendor scored AV:L - treat the local vector as the authoritative severity anchor but assess your own exposure if untrusted input ever reaches a Db2 connection string. |
| Exploit ScenarioDerived | An application allows a user or lower-privileged operator to influence part of a Db2 JDBC connection string (for example a data-source parameter or a 'test connection' feature). The attacker supplies a crafted JDBC URL containing malicious properties that the Db2 driver resolves at connect time, causing arbitrary code to execute with the privileges of the application process. No public POC is currently referenced, and CVSS AC:L indicates the injection is straightforward once URL control is obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 17, 2026
Code injection leading to remote code execution affects IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 when an attacker can influence the JDBC connection URL passed to the driver. An attacker who controls the JDBC URL (typically via an application that builds connection strings from user input) can inject malicious properties or references that cause arbitrary code to execute in the context of the connecting application/driver host. IBM has released a fix; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
RemediationAI
Patch available per vendor advisory - apply the IBM-provided fix pack or iFix documented at https://www.ibm.com/support/pages/node/7279479 for the appropriate Db2 line (11.5.x or 12.1.x); the exact fixed version was not enumerated in the provided data, so consult that advisory for the precise level. As a compensating control until patched, ensure applications never construct JDBC connection URLs from untrusted or user-supplied input: hard-code or allow-list the driver class, host, port, and database name, and reject or strip user influence over URL properties and query parameters (trade-off: requires an application code/config review and may break flexible multi-tenant connection configuration). Where feasible, run the connecting application under a least-privilege service account so that any code execution is contained (trade-off: does not stop the injection, only limits blast radius).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection) and resides in how the IBM Db2 JDBC driver interprets connection URLs. JDBC URLs and their embedded properties can reference class names, plugin handlers, or data-source parameters that the driver resolves at connect time; if any portion of that URL is derived from untrusted input, an attacker can steer the driver into loading or invoking attacker-chosen code. The affected component is the IBM Db2 database client/driver stack (CPE cpe:2.3:a:ibm:db2), spanning the 11.5 maintenance line and the newer 12.1 line. Because the flaw is triggered through the driver's own URL/property parsing rather than through the network wire protocol, exploitation is tied to the process that constructs and consumes the connection string.
Know when Db2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attacker needs local access and low privileges to influence the JDBC URL (AV:L, PR:L); injection is straightforward (AC:L) and code execution yields full C/I/A impact.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control.
Executive ViewAI
IBM Db2's JDBC driver (versions 11.5.0-11.5.9 and 12.1.0-12.1.4) contains a critical remote code execution vulnerability triggered through manipulated database connection strings. Organizations where applications build connection URLs from user input face risk of complete database server compromise, potentially affecting customer data integrity and business continuity. Patch availability makes this a time-sensitive priority for immediate deployment.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Stack-based buffer overflow in the SQL/PSM (aka SQL Persistent Stored Module) Stored Procedure (SP) infrastructure in IB
IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a stack-bas
Stack-based buffer overflow in IBM DB2 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on Linux
IBM DB2 9.5 uses world-writable permissions for nodes.reg, which has unspecified impact and attack vectors. Rated critic
Remote code execution in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 lets unauthenticated network attackers run arbitrary co
Privilege escalation in IBM Db2 (data server versions 11.5.0-11.5.9 and 12.1.0-12.1.5) allows an attacker to submit a sp
Memory-corruption in IBM Db2's IXF file IMPORT parser lets an attacker supply a crafted IXF data file that overflows a s
Stack-based buffer overflow in the Java Stored Procedure infrastructure in IBM DB2 9.1 before FP12, 9.5 through FP9, 9.7
Directory traversal vulnerability in the UTL_FILE module in IBM DB2 and DB2 Connect 10.1 before FP1 on Windows allows re
IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system
Integer signedness error in the db2dasrrm process in the DB2 Administration Server (DAS) in IBM DB2 9.1 through FP11, 9.
The Stored Procedure infrastructure in IBM DB2 9.5, 9.7 before FP9a, 10.1 before FP3a, and 10.5 before FP3a on Windows a
Exploit-DB