CVE Intelligence
Analysis AI-assisted

CVE-2026-10109: IBM Db2 Remote Code Execution via Pre-Auth DRDA Handshake

CVE-2026-10109 affects IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4. The flaw is a remote code execution issue caused by improper handling of the DRDA handshake before authentication, rated critical with a CVSS 3.1 base score of 9.8. The record lists no fixed versions, so administrators should consult the IBM advisory and prioritize inventory and exposure reduction.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-10109 affects IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4. The issue is described as remote code execution caused by improper pre-authentication DRDA handshake handling. The CNA assigned a critical severity, a CVSS 3.1 base score of 9.8, and the weakness type CWE-94 (Code Injection).

Impact

  • The CVSS vector indicates a network attack vector, low complexity, no privileges required, no user interaction, and high impact to confidentiality, integrity and availability.
  • Remote code execution would let an attacker run code in the context of the affected database service. The exact privilege level obtained is not stated in the available record.

Affected products and versions

  • IBM Db2 from 11.5.0 through 11.5.9.
  • IBM Db2 from 12.1.0 through 12.1.4.

The record does not list any fixed version. This absence does not mean no fix exists; the vendor advisory should be checked for remediation details.

Exploitation status

The record shows this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation appears in the sources consulted. The FIRST EPSS estimate is 0.0086 (percentile 0.57417), dated 2026-10-13 in the record.

Remediation and mitigation

  • Review the IBM support advisory for fixed releases and apply vendor updates to supported Db2 instances.
  • Inventory all Db2 instances and identify those within the affected version ranges.
  • Restrict network access to Db2 DRDA listeners so only trusted hosts and application servers can reach them.
  • Prioritize internet-facing and business-critical database servers for remediation.
  • If patching must be delayed, apply network segmentation and tighten firewall rules as temporary compensating controls.

Detection guidance

  • Monitor network traffic to Db2 listeners for connection attempts from unexpected or untrusted sources.
  • Review database and host logs for unusual activity, such as unexpected child processes or file changes associated with the database service.
  • Correlate database alerts with network telemetry to identify early signs of abuse.

Limitations of the available information

  • The record contains no fixed versions and no vendor advisory content was reviewed in this analysis.
  • No technical details of the trigger condition are available in the record, and no proof-of-concept information is provided.
  • The title was missing in the source record and has been written from the description.
  • The CVSS data comes from the CNA; no independent scoring is included.
  • Whether the flaw is exploited beyond the sources consulted is unknown.

Frequently asked questions

Is CVE-2026-10109 known to be exploited?

The record shows it is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed exploitation appears in the sources consulted.

Which IBM Db2 versions are affected?

The record lists IBM Db2 from 11.5.0 through 11.5.9 and from 12.1.0 through 12.1.4.

Is a fixed version available?

The record lists no fixed versions. Check the IBM support advisory for remediation details rather than assuming none exists.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.