IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://www.ibm.com/support/pages/node/7279479 Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.8 · ibmNVD modified 2026-10-24 20:10
Affected (CPE criteria) 1
cpe:2.3:a:ibm:db2:*:*:*:*:*:*:*:*
References 1
- https://www.ibm.com/support/pages/node/7279479 Vendor Advisory