Loading vulnerability…
Pre-authentication DRDA Remote Code Execution in IBM Db2
CVE-2026-10109 is a remote code execution vulnerability in IBM Db2 Server 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 across all supported platforms. Improper handling of the pre-authentication DRDA handshake allows an unauthenticated network attacker to execute arbitrary code. The vulnerability is classified as CWE-94 and has a CVSS 3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The specific vulnerable functions and exploitation details have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits remote code execution on an affected Db2 server, with high impact to confidentiality, integrity, and availability. An attacker could access or modify information accessible to the compromised process and disrupt database services. The execution privilege level is not specified.
If you can’t patch tonight, do this now.
IBM states that no workarounds or mitigations are available. Apply the vendor-provided fix.
Patch, then assume compromise.
Apply IBM's interim fix for APAR DT471718, available through Fix Central. For the 11.5 release line, install the V11.5.9 Special Build #84653 or later containing the fix. For the 12.1 release line, install the V12.1.4 Special Build #86230 or later containing the fix. IBM states that these special builds can be applied to any affected level within the corresponding release line.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.