Loading vulnerability…
Privilege Escalation in IBM Db2 via Crafted Query
CVE-2026-10543 is an improper-authorization vulnerability in IBM Db2 Server. IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 are affected across supported platforms. A specially crafted query can exploit the flaw to elevate user privileges.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker to gain elevated privileges in the affected IBM Db2 installation.
If you can’t patch tonight, do this now.
No vendor workaround or mitigation is available. Apply the applicable IBM security update.
Patch, then assume compromise.
Apply IBM's interim fixes for APAR DT472016 from Fix Central. For Db2 11.5.9, apply Security Update #87984 or later. For Db2 12.1.4, apply Security Update #87349 or later; for Db2 12.1.5, apply Security Update #88454 or later. IBM states that the updates can be applied to any affected level of the corresponding release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.