{"id":"CVE-2026-105465","published":"2026-10-12T19:16:37.610","lastModified":"2026-10-13T16:17:14.080","description":"IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7291609","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM Db2 database instances with db2locssh enabled are vulnerable to privilege escalation, allowing attackers with access to the db2 instance to gain higher privileges and potentially full system access. This is particularly concerning because Db2 is a critical enterprise database system.","exploitability":"Exploitation requires local access to a Db2 instance with db2locssh enabled, making it moderately difficult but not highly complex to achieve, especially in environments where Db2 instances are already compromised or where attackers have gained initial access through other means.","blast_radius":"If exploited, this vulnerability could allow attackers to escalate privileges within the Db2 environment and potentially move laterally to other systems, given that Db2 is often used as a core enterprise database with extensive access to sensitive data.","remediation":"Disable db2locssh functionality for all Db2 instances or upgrade to IBM Db2 11.5.10 or 12.1.6 which contain the fix for this privilege escalation vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["database","privilege-escalation","ibm"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:57:44.720Z"}}