Review reviewHigh
CVE-2026-9762
IBM Db2, db2
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control.
- CVSS
- 7.8
- EPSS
- - - percentile
- CISA KEV
- Not listed
- Published
- 2026.07.18
Review review
The CVSS severity warrants an early asset and exposure review.
Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7.8
Vulnerability overview
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control.
Affected product and versions
- Product
- IBM Db2, db2
- Affected versions
- >= 11.5.0 <= 11.5.9, >= 12.1.0 <= 12.1.4, >= 12.1.0 < 12.1.5
- Fixed versions
- 12.1.5
Recommended response sequence
Confirm exposure before applying a vendor-supported change.
- 1Identify
Confirm that IBM Db2, db2 and an affected version are present.
- 2Prioritize
Combine exploitation signals with asset exposure and business criticality.
- 3Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
- 4Verify
Recheck the version, service health, access paths, and relevant logs.
Technical data
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-94