Db2
- Software type
- Software application
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, Db2 recorded 18 security vulnerabilities in the last 90 days, of which 8 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Db2 and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-113698IBM® Db2® is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query TableCVE-2026-78404IBM® Db2® is vulnerable to local privilege escalation via the db2pd utilityCVE-2026-18166IBM® Db2® is vulnerable to arbitrary library loading via the CREATE WRAPPER command, allowing a privileged database user to read sensitive files from the host filesystemCVE-2026-105466IBM® Db2® is vulnerable to a denial of service when inserting into a table with XML columns under specific conditionsCVE-2026-105465IBM® Db2® is vulnerable to privilege escalation when db2ssh is enabled with the db2 instance| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-113698IBM® Db2® is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table | Exploitation statusNot confirmed | FixYes |
| SeverityMedium |
CVE-2026-78404IBM® Db2® is vulnerable to local privilege escalation via the db2pd utility | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-18166IBM® Db2® is vulnerable to arbitrary library loading via the CREATE WRAPPER command, allowing a privileged database user to read sensitive files from the host filesystem | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-105466IBM® Db2® is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-105465IBM® Db2® is vulnerable to privilege escalation when db2ssh is enabled with the db2 instance | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-105464IBM® Db2® is vulnerable to a local attacker with DBADM authorization gaining elevated privileges due to improper privilege management | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityHigh |
|---|
CVE-2026-104364IBM® Db2® Denial of Service | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityLow |
|---|
CVE-2026-104332IBM® Db2® Denial of Service | Exploitation statusNot exploited | FixYes | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-17463IBM® Db2® could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption | Exploitation statusNot exploited | FixYes | Published09/14/2026 | SeverityMedium |
|---|
CVE-2026-16702IBM® Db2® federated server could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference | Exploitation statusNot exploited | FixYes | Published09/14/2026 | SeverityMedium |
|---|
CVE-2026-15955IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths | Exploitation statusNot exploited | FixYes | Published09/14/2026 | SeverityHigh |
|---|
CVE-2026-87958IBM® Db2® is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions | Exploitation statusNot exploited | FixYes | Published09/10/2026 | SeverityHigh |
|---|
CVE-2026-86093IBM® Db2® federated server could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands under certain conditions | Exploitation statusNot exploited | FixYes | Published09/10/2026 | SeverityHigh |
|---|
CVE-2026-86087IBM® Db2® could allow an authenticated user to send a specially crafted request to write arbitrary files on the system | Exploitation statusNot exploited | FixYes | Published09/10/2026 | SeverityMedium |
|---|
CVE-2026-18097IBM® Db2® federated server could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files. | Exploitation statusNot exploited | FixYes | Published08/12/2026 | SeverityMedium |
|---|
CVE-2026-18096IBM® Db2® could allow a local attacker to cause a denial of service due to a memory leak | Exploitation statusNot exploited | FixYes | Published08/12/2026 | SeverityLow |
|---|
CVE-2026-16480IBM® Db2® is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data. | Exploitation statusNot exploited | FixYes | Published08/12/2026 | SeverityMedium |
|---|
CVE-2026-10543IBM® Db2® is vulnerable to privilege escalation with a specially crafted query | Exploitation statusNot exploited | FixYes | Published08/12/2026 | SeverityHigh |
|---|
CVE-2026-10534IBM® Db2® is vulnerable to buffer overflow in the IXF IMPORT parser | Exploitation statusNot exploited | FixYes | Published08/12/2026 | SeverityHigh |
|---|
CVE-2026-10695IBM® Db2® is vulnerable to a denial of service when running non fenced federated queries | Exploitation statusNot exploited | FixYes | Published07/30/2026 | SeverityMedium |
|---|
CVE-2026-10535IBM® Db2® is vulnerable to buffer overflow in setgid helper db2flacc which can lead to privilege escalation and instance compromise from an unprivileged shell | Exploitation statusNot exploited | FixYes | Published07/30/2026 | SeverityHigh |
|---|
CVE-2026-9762IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control | Exploitation statusNot exploited | FixYes | Published07/17/2026 | SeverityHigh |
|---|
CVE-2026-7771IBM® Db2® is vulnerable to a trap when compiling specially crafted statements containing subqueries could lead to a denial of service | Exploitation statusNot exploited | FixYes | Published07/17/2026 | SeverityMedium |
|---|
CVE-2026-11906IBM® Db2® federated server is vulnerable to a denial of service due to improper neutralization of special elements in the data query logic of XMLTable-derived columns by autheticated user | Exploitation statusNot exploited | FixYes | Published06/30/2026 | SeverityMedium |
|---|
CVE-2026-10109IBM® Db2® is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling | Exploitation statusNot exploited | FixYes | Published06/30/2026 | SeverityCritical |
|---|
CVE-2025-36372IBM® Db2® could disclose sensitive information to an authenticated user from the monitoring and event tables | Exploitation statusNot exploited | FixYes | Published06/30/2026 | SeverityMedium |
|---|
CVE-2026-6938IBM® Db2® is vulnerable to authorization bypass when uploading to a remote object storage path with a special query | Exploitation statusNot exploited | FixYes | Published05/27/2026 | SeverityMedium |
|---|
CVE-2026-6053IBM® Db2® is vulnerable to a denial of service when a specially crafted query is run with range partitioned tables | Exploitation statusNot exploited | FixYes | Published05/27/2026 | SeverityMedium |
|---|
CVE-2026-6052IBM® Db2® is vulnerable to running out of memory when executing certain queries with MDC tables | Exploitation statusNot exploited | FixYes | Published05/27/2026 | SeverityMedium |
|---|
CVE-2026-6051IBM® Db2® is vulnerable to a denial of service when executing a specially crafted query with a small statement heap | Exploitation statusNot exploited | FixYes | Published05/27/2026 | SeverityMedium |
|---|
CVE-2026-1718IBM® Db2® is vulnerable to a denial of service with a specially crafted query when running an AUTONOMOUS procedure | Exploitation statusNot exploited | FixYes | Published05/27/2026 | SeverityHigh |
|---|
CVE-2025-13755IBM® Db2® is vulnerable to credential exposure in db2diag when executing specific testcase buckets | Exploitation statusNot exploited | FixYes | Published05/26/2026 | SeverityMedium |
|---|
CVE-2026-1577IBM® Db2® is vulnerable to a denial of service with a specially crafted query involving multiple subqueries | Exploitation statusNot exploited | FixYes | Published04/30/2026 | SeverityMedium |
|---|
CVE-2025-36122IBM® Db2® is vulnerable to a denial of service with a specially crafted query when stmtheap is set to automatic | Exploitation statusNot exploited | FixYes | Published04/30/2026 | SeverityMedium |
|---|
CVE-2025-14688IBM® Db2® is vulnerable to a denial of service when fetching from certain tables under specific configurations | Exploitation statusNot exploited | FixYes | Published04/30/2026 | SeverityMedium |
|---|
CVE-2026-1352IBM® Db2® is vulnerable to a trap or return SQLCODE -901 when compiling a specially crafted query with a defined index | Exploitation statusNot exploited | FixYes | Published04/22/2026 | SeverityMedium |
|---|
CVE-2025-36186IBM Db2 privilege escalation | Exploitation statusNot exploited | FixYes | Published11/07/2025 | SeverityHigh |
|---|
CVE-2025-36185IBM Db2 denial of service | Exploitation statusNot exploited | FixYes | Published11/07/2025 | SeverityMedium |
|---|
CVE-2025-36136IBM denial of service | Exploitation statusNot exploited | FixYes | Published11/07/2025 | SeverityMedium |
|---|
CVE-2025-36131IBM Db2 information disclosure | Exploitation statusNot exploited | FixYes | Published11/07/2025 | SeverityMedium |
|---|
CVE-2025-36008IBM Db2 denial of service | Exploitation statusNot exploited | FixYes | Published11/07/2025 | SeverityMedium |
|---|
CVE-2025-36006IBM Db2 denial of service | Exploitation statusNot exploited | FixYes | Published11/07/2025 | SeverityMedium |
|---|
CVE-2025-33012IBM Db2 improper account lockout | Exploitation statusNot exploited | FixYes | Published11/07/2025 | SeverityMedium |
|---|
CVE-2025-2534IBM Db2 denial of service | Exploitation statusNot exploited | FixYes | Published11/07/2025 | SeverityMedium |
|---|
CVE-2024-47118IBM Db2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query | Exploitation statusNot exploited | FixYes | Published11/07/2025 | SeverityMedium |
|---|
CVE-2025-36010IBM Db2 for Linux denial of service | Exploitation statusNot exploited | FixYes | Published07/29/2025 | SeverityMedium |
|---|
CVE-2025-33114IBM Db2 for Linux denial of service | Exploitation statusNot exploited | FixYes | Published07/29/2025 | SeverityMedium |
|---|
CVE-2025-33092IBM Db2 for Linux code execution | Exploitation statusNot exploited | FixYes | Published07/29/2025 | SeverityHigh |
|---|
CVE-2025-2533IBM Db2 for Linux denial of service | Exploitation statusNot exploited | FixYes | Published07/29/2025 | SeverityMedium |
|---|
CVE-2024-52894IBM Db2 for Linux, UNIX and Windows denial of service | Exploitation statusNot exploited | FixYes | Published07/29/2025 | SeverityMedium |
|---|
55 Results | Page 1 of 2