What is the CVSS score of EUVD-2026-57619?

EUVD-2026-57619 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for EUVD-2026-57619?

Yes, a patch is available for EUVD-2026-57619. Update the affected software to the latest version immediately.

IBM Db2 EUVD-2026-57619

| CVE-2026-18097 MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2026-08-12 ibm

GHSA-q83p-h7pj-3m3p

Information Disclosure IBM Microsoft Db2

5.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local low-privilege OS access suffices to read trace files; only confidentiality is impacted as passwords are exposed with no write or availability consequence.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 21:41 vuln.today

CVE Published

Aug 12, 2026 - 20:48 nvd

MEDIUM 5.5

DescriptionCVE.org

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files.

AnalysisAI

IBM Db2 on Linux, UNIX, and Windows exposes cleartext database passwords by writing them into diagnostic trace files, affecting versions 11.5.0-11.5.9 and 12.1.0-12.1.5, including DB2 Connect Server. Any low-privilege local OS user with read access to the Db2 trace directory can harvest plaintext credentials without requiring database-level authentication or elevated system rights. IBM has released a patch; no active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Technical ContextAI

IBM Db2 is a widely deployed enterprise relational database management system for Linux, UNIX, and Windows, identified by CPE cpe:2.3:a:ibm:db2:*:*:*:*:*:*:*:*. The vulnerability is rooted in CWE-532 - Insertion of Sensitive Information into Log File - where the Db2 tracing subsystem records diagnostic output that includes authentication credentials in plain, unredacted text. Trace files are written to host filesystem paths typically under the Db2 instance directory. DB2 Connect Server, included in the affected scope, acts as a gateway for mainframe and midrange database connectivity, making it a particularly sensitive target as it may broker credentials for multiple upstream systems. The core failure is the absence of sanitization or masking of password material prior to writing to persistent trace output.

RemediationAI

Apply the IBM-released patch per the vendor advisory at https://www.ibm.com/support/pages/node/7282952; the exact patched version should be confirmed directly in that advisory, as it was not specified in available intelligence data. While patching, restrict filesystem permissions on Db2 trace file directories to the db2 instance owner and dedicated DBA accounts only, preventing low-privilege OS users from reading trace output - note this may complicate future diagnostic work by non-DBA support personnel. Disable tracing when not actively performing diagnostics, treating trace collection as a privileged operational action requiring explicit authorization. Audit existing trace files for captured credential strings and rotate all potentially exposed database passwords immediately. On DB2 Connect Server deployments, prioritize remediation given that compromised credentials may grant access to multiple connected backend systems.