IBM Db2 EUVD-2026-78054

Based on IBM's CVSS vector (PR:N/UI:N/AC:L), exploitation requires no authentication and no user interaction - the attacker need only reach the Db2 network listener. Limiting factors: in well-hardened enterprise environments, Db2 ports are not exposed to untrusted networks; OS-level file write impact is constrained by the permissions of the Db2 process account; and the exact code path triggering the traversal (e.g., a specific SQL statement, REST API call, or administrative command) is not identified in available data. The specific Db2 feature or protocol endpoint involved is not disclosed in the vendor description, which creates uncertainty about whether a minimal TCP connection suffices or whether some form of Db2 protocol framing is required even without credentials.

IBM's own CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) scores this at 7.5 and implies fully unauthenticated, low-complexity remote exploitation - a striking claim for an enterprise database. Real-world risk warrants scrutiny: production Db2 instances should not be network-exposed without authentication, and in most enterprise deployments the Db2 port (50000/TCP by default) is behind firewall controls. If the PR:N vector is accurate, any system with Db2 exposed to untrusted networks is at critical risk of file overwrite - which could be leveraged to plant web shells, overwrite config files, or corrupt binaries. The I:H/A:N metrics suggest file writes are possible but availability is not directly impacted, though overwriting critical OS or Db2 files could cause indirect DoS. EPSS data is not present in the provided intelligence, and no KEV listing or POC is reported, suggesting low current exploitation activity despite the permissive CVSS. The PR:N assignment by IBM itself should be taken seriously as the authoritative vendor position, but defenders should verify whether the vulnerable code path requires any implicit session or connection establishment.

A remote attacker sends a crafted request to an exposed Db2 service containing a path traversal sequence (e.g., '../../etc/cron.d/backdoor') in a file path parameter. The server writes attacker-controlled content to the traversed path without validating the canonical destination, potentially planting a cron job or overwriting a configuration file for later privilege escalation. No public POC exists at time of analysis, but the low-complexity, unauthenticated CVSS vector indicates the mechanism does not require elaborate setup.