IBM Db2 EUVD-2026-97764

Requires a pre-existing low-privileged local account (AV:L, PR:L) on a host running a vulnerable IBM Db2 instance (11.5.0-11.5.9 or 12.1.0-12.1.5), plus the ability to execute the db2pd monitoring/diagnostic utility. Exploitation is strictly local - there is no remote attack path and no victim user interaction is needed. Limiting factors: the attacker must already have authenticated local shell access to the database server, so the flaw is not reachable by remote or unauthenticated actors and is most relevant on shared or multi-tenant Db2 hosts; applying the vendor patch removes the condition.

This is a moderate-severity, real-but-not-urgent issue. The vendor CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 6.5) describes a local-only vulnerability: the attacker must already possess a low-privileged local account (AV:L/PR:L) but needs no user interaction and faces low attack complexity, and the changed scope (S:C) indicates the flaw lets the attacker cross a security boundary - consistent with the described privilege escalation via the db2pd utility. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so there is no signal of active or probable exploitation; exploitation status is 'no public exploit identified at time of analysis.' Note a conflict worth flagging: the title and CWE-269 describe a privilege escalation, yet the vendor impact metrics are C:H/I:N/A:N (confidentiality-only, no integrity or availability impact), which is unusual for a true privilege-escalation outcome where an attacker typically also gains the ability to modify or disrupt - verify the precise impact with IBM advisory node 7291612. Because exploitation requires pre-existing local access, this is a defense-in-depth priority (patch in normal cycles, prioritize multi-user/shared Db2 hosts) rather than an emergency; the absence of EPSS/KEV/POC data does not prove low risk, only that no exploitation signal was supplied.

A low-privileged local user on a server running a vulnerable IBM Db2 instance invokes the db2pd diagnostic utility in a way that abuses improper privilege management, allowing them to access resources or privileges across a security boundary (scope change) beyond their own account. No remote access and no user interaction by a victim are required, but the attacker must already have a local foothold. No public exploit code was identified in the provided data.