PatchTheCVEdb2 vulnerabilities and fixes
Recent CVEs affecting db2, with upgrade or downgrade steps. 7 tracked.
db2 has 7 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 6. Most recent: 2026-08-12. Highest priority: CVE-2026-10543 (score 42/100).
- CVE-2026-10535 HIGH 8.4 UPGRADE IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2
- CVE-2026-10695 MEDIUM 6.2 UPGRADE IBM Db2 12.1.0 through 12.1.4 federated server is vulnerable to a denial of service when running non fenced fe
- CVE-2026-10543 HIGH 8.2 UPGRADE IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a speciall
- CVE-2026-10534 HIGH 8.4 UPGRADE IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer overflow in the IXF IMPORT pa
- CVE-2026-18097 MEDIUM 5.5 UPGRADE UPGRADE IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Ser
- CVE-2026-16480 MEDIUM 4.3 UPGRADE IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an improper authorization vulnerabilit
- CVE-2026-18096 LOW 3.3 DOWNGRADE DOWNGRADE IBM Db2 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to cause
FAQ
How do I fix db2 vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is db2 being exploited right now?
None of the tracked db2 CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which db2 CVE should I patch first?
CVE-2026-10543 currently ranks highest (42/100): IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a speciall.