Initial Assessment: IBM Db2 Security Vulnerabilities (August 2026)
Summary:
IBM has disclosed a total of five vulnerabilities affecting Db2. The most critical issues are:
- CVE-2026-10534 (CVSS 8.4): Buffer overflow in the IXF import parser that may allow remote code execution.
- CVE-2026-10543 (CVSS 8.2): Privilege escalation through specially crafted queries.
The password-related issue highlighted in the Heise article (CVE-2026-18097) is technically less critical than the two high-severity vulnerabilities above. It allows the disclosure of plaintext passwords in trace files but requires local system access.
IBM currently states that no active exploitation is known.
1. Affected Systems and Versions
Affected Product Lines
| Product | Affected Versions |
|---|---|
| IBM Db2 Client | 11.5.0 to 11.5.9 |
| IBM Db2 Server | 11.5.0 to 11.5.9 |
| IBM Db2 Client | 12.1.0 to 12.1.5 |
| IBM Db2 Server | 12.1.0 to 12.1.5 |
Most vulnerabilities affect Linux, UNIX, and Windows installations. Some vulnerabilities apply exclusively to server deployments.
Vulnerability Breakdown
| CVE | Affected Components |
|---|---|
| CVE-2026-10534 | Db2 Client & Server 11.5.x / 12.1.x |
| CVE-2026-10543 | Db2 Server 11.5.x / 12.1.x |
| CVE-2026-18097 | Db2 Server / Federated Server |
| CVE-2026-16480 | Db2 Server |
| CVE-2026-18096 | Db2 12.1.5 Server only |
2. Recommendations
High Priority
- Verify whether Db2 versions 11.5.x or 12.1.x are in use.
- Apply security updates as soon as possible.
- Closely monitor IXF import functionality until updates have been installed.
- Review administrative and service accounts for unusual privilege changes or escalations.
Medium Priority
- Review trace logging configurations.
- Examine existing trace files for plaintext passwords.
- Rotate any passwords that may have been exposed or logged.
IBM-Provided Fixed Versions
IBM identifies the following security levels as containing the fixes:
| Release | Secure Version |
|---|---|
| Db2 11.5.x | Security Update #87984 for V11.5.9 or later |
| Db2 12.1.4 | Security Update #86025 or #87349, or later |
| Db2 12.1.5 | Security Update #88454 or later |
Official IBM Links
Patch Downloads
-
Db2 v11.5.9 Published Update Downloadshttps://www.ibm.com/support/pages/node/7087189
-
Db2 v12.1.4 Published Update Downloadshttps://www.ibm.com/support/pages/node/7267513
-
Db2 v12.1.5 Published Update Downloadshttps://www.ibm.com/support/pages/node/7282633
Official Security Advisories
-
CVE-2026-10534
Security Bulletin: IBM® Db2® is vulnerable to buffer overflow in the IXF IMPORT parser (CVE-2026-10534)https://www.ibm.com/support/pages/node/7279461 -
CVE-2026-10543
Security Bulletin: IBM® Db2® is vulnerable to privilege escalation with a specially crafted query (CVE-2026-10543)https://www.ibm.com/support/pages/node/7282949 -
CVE-2026-18097
Security Bulletin: IBM® Db2® Federated Server could allow a local attacker to obtain sensitive information due to the logging of plaintext passwords in trace files (CVE-2026-18097)https://www.ibm.com/support/pages/node/7282952 -
CVE-2026-16480
Security Bulletin: IBM® Db2® is affected by an improper authorization vulnerability in a certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data (CVE-2026-16480)https://www.ibm.com/support/pages/node/7282951 -
CVE-2026-18096
Security Bulletin: IBM® Db2® could allow a local attacker to cause a denial of service due to a memory leak (CVE-2026-18096)https://www.ibm.com/support/pages/node/7282953