IBM Db2 EUVD-2026-97771

Requires the attacker to already have local access to the host and a low-privilege authenticated principal (PR:L) on an affected Db2 LUW or DB2 Connect Server instance (versions 11.5.0-11.5.9 or 12.1.0-12.1.5). No user interaction and no special non-default configuration is called out in the description. Exploitation is LIMITED by the need for an existing local foothold and valid credentials - it cannot be performed by a fully remote, unauthenticated attacker - which substantially narrows realistic exposure to insiders or attackers who have already breached another service on the host.

This is a credible, actionable priority for environments running affected IBM Db2 LUW versions, though not an emergency. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C) describes a local privilege-escalation flaw: an attacker needs existing low-privilege access to the host or a low-privilege Db2 account (PR:L), but complexity is low (AC:L), no user interaction is required (UI:N), and the changed scope (S:C) with C:H/I:H/A:H drives the 8.8 score - consistent with escalation from a constrained account to full database or underlying-OS control. No EPSS score was supplied, so statistical exploitation probability cannot be weighed. There is no CISA KEV listing and no POC/exploit code referenced in the input, so this is not confirmed as actively exploited. SSVC inputs (exploitation, automatability) were not provided; however, the local attack vector and authentication prerequisite make opportunistic mass exploitation unlikely, pointing toward a post-compromise or insider-driven escalation path rather than a remotely wormable threat. Net: high technical impact gated by a meaningful local-access precondition - patch promptly, but it ranks below comparable remote unauthenticated flaws.

An attacker who already holds a low-privilege local account or shell on a Db2 LUW/Connect Server host (e.g., a compromised application service account or a limited database user) abuses the improper privilege-management flaw to escalate to Db2 instance-owner or operating-system-level privileges. No exploit code is referenced in the input, so exploitation is currently theoretical; the local vector and required authentication limit it to attackers with an existing foothold.