Quick answers
- Is CVE-2026-10109 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-10109 being exploited in the wild.
- How severe is CVE-2026-10109?
- Critical severity, with a CVSS score of 9.8, published 30 June 2026.
- Which products and versions are affected?
- IBM Db2 11.5.0 - 11.5.9, 12.1.0 - 12.1.4.
- Is there a fix for CVE-2026-10109?
- A patch was published on 2026-06-23: Special builds released for V11.5 and V12.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-10109 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-10109?
- Check whether you run IBM Db2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
IBM Db2 contains a code injection vulnerability (CWE-94) within its implementation of the Distributed Relational Database Architecture (DRDA) protocol. The flaw exists in the pre-authentication handshake process, where improper validation of initial connection requests allows for remote code execution. An unauthenticated attacker can trigger this vulnerability over the network by sending a specially crafted DRDA handshake packet. Successful exploitation grants the attacker the ability to execute arbitrary code with the privileges of the Db2 instance owner. IBM has released special builds for versions 11.5.9 and 12.1.4 to remediate this issue.
Affected products
- IBM Db2 11.5.0 - 11.5.9, 12.1.0 - 12.1.4
Timeline
- 2026-06-23: disclosed: Initial publication by IBM
- 2026-06-23: patched: Special builds released for V11.5 and V12.1
- 2026-06-30: advisory: NVD publication date