IBM Db2 Genius Hub EUVD-2026-45305

The attacker needs network access to a reachable Db2 Genius Hub (1.1, 1.1.1, or 1.1.2) or IBM Agentics 1.0 service interface that accepts input routed to the vulnerable dangerous function; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication (PR:N), no user interaction (UI:N), and only low attack complexity are required against the affected versions. The primary limiting factors are deployment-based rather than technical: these are relatively new, narrowly deployed IBM AI products, so exposure depends on the instance being network-accessible to the attacker and running one of the named versions. The exact vulnerable feature, protocol, and any non-default configuration requirement are NOT disclosed in the description, so the true precondition surface cannot be fully confirmed from available data and should be validated against the IBM advisory.

The signals are mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) describes a worst-case, remotely exploitable, unauthenticated, low-complexity flaw with total impact - which would normally make it a top patching priority. However, the EPSS score is only 0.33% (25th percentile), indicating models currently rate near-term mass exploitation as unlikely, and the CVE is NOT in CISA KEV, with no public POC identified. This tension - critical CVSS but low EPSS and no exploitation evidence - suggests a genuinely severe but so-far-theoretical risk rather than an active campaign. No SSVC decision data was provided. The vague description ('dangerous functions without sufficient restrictions') means the exact sink and preconditions are not disclosed, so the PR:N/AC:L assumptions should be treated as vendor-assigned worst case and verified against actual deployment (these are newer, less ubiquitous IBM AI products, which likely limits exposed attack surface).

An attacker with network reach to an exposed Db2 Genius Hub or Agentics endpoint submits a crafted request whose payload is passed into an unrestricted dangerous function, causing the server to execute attacker-supplied code or return sensitive data. Given the CVSS AV:N/AC:L/PR:N/UI:N vector, this requires no authentication, no user interaction, and low complexity. No public exploit code has been identified, so a working attack would currently require the attacker to reverse-engineer the specific sink.