cyfenced.com →

[ CVE-2026-18166 · Published 12 Oct 2026 ]

Vulnerability in IBM Db2

CVSS 7.7 EPSS <1%2 agency advisoriesNo fix listed yet

[ Description ]Official description

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitive information due to improper authorization when using the CREATE WRAPPER command.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

  • CERT-FRCERTFR-2026-AVI-1291

    Multiple vulnerabilities in IBM products Translated from French

    Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

    CVE-2026-49978CVE-2025-27895CVE-2026-59651+195 more CVEs
  • BSI CERT-BundWID-SEC-2026-3837

    IBM DB2: Multiple vulnerabilities Translated from German

    CVE-2026-18166CVE-2026-104332CVE-2026-104364+4 more CVEs

[ References ]References