Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

IBM Cloud APM and DB2 Denial of Service via Malformed Query

CVE-2026-3676 · published 5 months ago
Summary

IBM Cloud APM and DB2 servers may be affected if an authenticated user sends a specially crafted query. This could cause the server to become unresponsive, making it unavailable to users. Update to the latest version to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ibm cloud_application_performance_managemen 8.1.4
cpe:2.3:a:ibm:cloud_application_performance_managemen:8.1.4:*:*:*:advanced_private:*:*:*
Original advisory text
IBM Cloud APM, Base Private 8.1.4 and IBM Cloud APM, Advanced Private 8.1.4 IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a denial of ...
IBM Cloud APM, Base Private 8.1.4 and IBM Cloud APM, Advanced Private 8.1.4 IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in the data query logic of the Fenced environment.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-1284Improper Validation of Specified Quantity in Input
Timeline
Published27 May 2026
Updated4 Nov 2026
First seen2 Jun 2026
Sources
CVE-2026-3676 · NVD
Track software like this
Free during beta