internet-facing-service-vulnerabilitywidely-deployed-product-advisoryproof-of-concept-release

Critical Pre-Auth RCE in IBM Db2 Exposes Unpatched Servers

Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Jun 30, 2026

IBM disclosed CVE-2026-10109, a critical remote code execution flaw in IBM Db2 caused by improper handling of the pre-authentication DRDA handshake. The vulnerability is tracked as CWE-94 and carries a CVSS 3.1 score of 9.8, indicating that attackers can exploit it remotely over the network without privileges or user interaction.

The issue affects IBM Db2 Server versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 across all platforms. IBM said there is no workaround or mitigation and directed customers to obtain interim special builds and the latest security fixes through Fix Central to remediate exposed systems.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Jun 23, 2026

Jun 23, 20265mo ago
IBM releases interim special builds for affected Db2 versions
IBM released interim special builds through Fix Central for the impacted Db2 release lines as remediation for CVE-2026-10109. IBM also stated that no workaround or mitigation is available aside from updating to a patched version.
Security Bulletin: IBM® Db2® is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling (CVE-2026-10109)
Jun 23, 20265mo ago
IBM discloses critical Db2 RCE vulnerability CVE-2026-10109
IBM disclosed CVE-2026-10109, a critical remote code execution flaw in Db2 caused by improper handling of the pre-authentication DRDA handshake. The issue affects Db2 Server versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4, with no privileges or user interaction required for exploitation.
Security Bulletin: IBM® Db2® is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling (CVE-2026-10109)

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Pre-authentication DRDA Remote Code Execution in IBM Db2 (CVE-2026-10109)

Organizations

1 linked

International Business Machines

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Cvefeed High SeverityAdvisories · Jun 30, 2026

CVE-2026-10109 - IBM® Db2® is vulnerable to remote code execution due to improper pre-auth DRDA handshake handlingOpen source ↗

Ibm SupportNews · Jun 23, 2026

Security Bulletin: IBM® Db2® is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling (CVE-2026-10109)Open source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Critical Pre-Auth RCE in IBM Db2 Exposes Unpatched Servers

How this story unfolded

IBM releases interim special builds for affected Db2 versions

IBM discloses critical Db2 RCE vulnerability CVE-2026-10109

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

IBM Db2 Privilege Escalation Flaw Allows Unauthorized Access via Crafted Query

Critical Pre-Auth Deserialization Flaw Exposes IBM WebSphere Servers to RCE

Critical RCE in IBM WebSphere Web Server Plug-ins Exposes Servers to Full Compromise

Critical Pre-Auth RCE in IBM Db2 Exposes Unpatched Servers

How this story unfolded

IBM releases interim special builds for affected Db2 versions

IBM discloses critical Db2 RCE vulnerability CVE-2026-10109

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

IBM Db2 Privilege Escalation Flaw Allows Unauthorized Access via Crafted Query

Critical Pre-Auth Deserialization Flaw Exposes IBM WebSphere Servers to RCE

Critical RCE in IBM WebSphere Web Server Plug-ins Exposes Servers to Full Compromise