CVE-2026-11906
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 for Linux, UNIX, and Windows (including Db2 Connect Server) contain a denial-of-service vulnerability. An authenticated user can exploit improper neutralization of special elements in the data query logic for XMLTable-derived columns, causing a denial of service.
Risk Assessment
The risk is that an authenticated user can disrupt database operations, potentially leading to unavailability of critical business applications relying on IBM Db2.
Recommendation
Immediately upgrade IBM Db2 to version 11.5.10 or later (for the 11.5 series) and 12.1.5 or later (for the 12.1 series). If an upgrade is not possible, restrict user permissions for executing XMLTable queries.
Other vulnerabilities in IBM Db2
See all- CVE-2015-1935High
The scalar-function implementation in IBM DB2 versions 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors.
- CVE-2014-3094High
IBM DB2 has a stack-based buffer overflow affecting versions 9.7 through FP9a, 9.8 through FP5, 10.1 through FP4, and 10.5 before FP4 on Linux, UNIX, and Windows. This allows remote authenticated users to execute arbitrary code via a crafted ALTER MODULE statement.
- CVE-2014-0907High
Multiple untrusted search path vulnerabilities in setuid and setgid programs in IBM DB2 9.5, 9.7 before FP9a, 9.8, 10.1 before FP3a, and 10.5 before FP3a on Linux and UNIX allow local users to gain root privileges via a Trojan horse library.
- CVE-2013-6744High
The Stored Procedure infrastructure in IBM DB2 versions 9.5, 9.7 before FP9a, 10.1 before FP3a, and 10.5 before FP3a on Windows allows remote authenticated users to gain privileges by leveraging the CONNECT privilege and the CREATE_EXTERNAL_ROUTINE authority.
- CVE-2026-10109Critical
IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 are vulnerable to remote code execution due to improper handling of DRDA handshake before authentication.
- CVE-2026-10534High
IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 are vulnerable to buffer overflow in the IXF IMPORT parser.
- CVE-2026-18097Medium
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files.
- CVE-2026-18096Low
IBM Db2 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to cause a denial of service due to a memory leak.
- CVE-2026-16480Medium
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an improper authorization vulnerability in a certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data.
- CVE-2026-10543High
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query.
Original NVD description (English source)
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in the data query logic of XMLTable-derived columns.