PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-105465 IBM CVE debrief

IBM Db2 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance. Affected versions include 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5. This vulnerability allows an attacker to potentially escalate privileges on affected systems. Defenders should assess exposure and apply patches to mitigate potential risks. The CVE record and source item provide details on the vulnerability and affected versions, but additional verification is necessary to confirm exposure and apply appropriate mitigations.

Vendor
IBM
Product
Db2
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-12
Original CVE updated
2026-10-13
Advisory published
2026-10-12
Advisory updated
2026-10-13

Who should care

Defenders responsible for IBM Db2 instances, particularly those with db2locssh enabled, should assess exposure and apply patches. This includes operators, platform administrators, and security teams managing IBM Db2 deployments. They should verify the exposure of IBM Db2 instances with db2locssh enabled, assess potential privilege escalation risks, and apply patches to affected versions. Additionally, defenders

Why it matters

Defenders should prioritize verifying exposure and applying patches for IBM Db2 instances where db2locssh is enabled to prevent potential privilege escalation.

  • Verify exposure of IBM Db2 instances with db2locssh enabled
  • Assess potential privilege escalation risks
  • Apply patches to affected versions
  • Monitor for exploitation attempts

Technical summary

IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 are vulnerable to privilege escalation when db2locssh is enabled with the db2 instance. This vulnerability is related to the db2locssh configuration and its interaction with the db2 instance. Defenders should prioritize verifying exposure and applying patches for IBM Db2 instances where db2locssh is enabled to prevent potential privilege escalation. The vulnerability does not require additional technical details beyond the affected versions and configurations.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for IBM Db2 instances where db2locssh is enabled.

Recommended defensive actions

  • Verify if db2locssh is enabled on IBM Db2 instances
  • Check if affected versions are in use and apply patches
  • Monitor for potential exploitation attempts

Evidence notes

The CVE record and source item provide details on the vulnerability and affected versions. However, defenders should verify the exposure of IBM Db2 instances with db2locssh enabled and assess potential privilege escalation risks. Additional verification tasks include reviewing vendor advisories, checking system configurations, and monitoring for exploitation attempts. The current information suggests that affected versions include 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5, but a

Sources and references

Verified primary and authoritative sources

  • CVE-2026-105465 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-105465

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-105465 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-105465

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.