Is CVE-2026-11906 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11906 being exploited in the wild.

How severe is CVE-2026-11906?

Medium severity, with a CVSS score of 6.5, published 30 June 2026.

Which products and versions are affected?

IBM Db2 11.5.0 - 11.5.9, 12.1.0 - 12.1.4; IBM DB2 Connect Server 11.5.0 - 11.5.9, 12.1.0 - 12.1.4.

Is there a fix for CVE-2026-11906?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11906 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-11906?

Check whether you run IBM Db2 or IBM DB2 Connect Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11906: IBM Db2 denial of service in XMLTable query logic

CVE-2026-11906 · Severity: medium · CVSS 6.5 · Published 2026-06-30

IBM Db2 is a database management system used by enterprises to store and manage critical business data. A vulnerability in how the system processes specific database queries could allow a registered user to crash the database server. This would result in a service outage, preventing applications and employees from accessing necessary data until the system is recovered.

Technologies: IBM Db2, IBM DB2 Connect Server. Vendors: IBM.

Quick answers

Is CVE-2026-11906 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11906 being exploited in the wild.
How severe is CVE-2026-11906?: Medium severity, with a CVSS score of 6.5, published 30 June 2026.
Which products and versions are affected?: IBM Db2 11.5.0 - 11.5.9, 12.1.0 - 12.1.4; IBM DB2 Connect Server 11.5.0 - 11.5.9, 12.1.0 - 12.1.4.
Is there a fix for CVE-2026-11906?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11906 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-11906?: Check whether you run IBM Db2 or IBM DB2 Connect Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

IBM Db2 (including Db2 Connect Server) is vulnerable to a denial of service (DoS) attack. The flaw is rooted in CWE-1284 (Improper Validation of Specified Quantity in Input) within the data query logic of XMLTable-derived columns. An authenticated attacker with network access can exploit this by submitting specially crafted queries that fail to be properly neutralized, leading to a system crash or hang. The vulnerability affects versions 11.5 and 12.1 across Linux, UNIX, and Windows platforms. IBM has released special builds (interim fixes) for versions 11.5.9 and 12.1.4 to remediate the issue.

Affected products

IBM Db2 for Linux, UNIX and Windows 11.5.0 - 11.5.9, 12.1.0 - 12.1.4
IBM Db2 Connect Server 11.5.0 - 11.5.9, 12.1.0 - 12.1.4

Timeline

2026-06-23: disclosed: Initial publication by IBM
2026-06-30: advisory: NVD publication date

References

https://www.ibm.com/support/pages/node/7277423

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.