Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

IBM Db2 Remote Code Execution via Malformed DRDA Request

CVE-2026-10109 · published 4 months ago
Summary

IBM Db2 versions 11.5 and 12.1 are at risk of being hacked through a specially crafted request. This could allow an attacker to execute malicious code on the server, potentially leading to data theft or system compromise. Users should update to the latest version to fix this issue.

Original advisory text
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling.
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published30 Jun 2026
Updated3 Nov 2026
First seen30 Jun 2026
Sources
CVE-2026-10109 · NVD
Track software like this
Free during beta