Local Privilege Escalation Vulnerability in IBM Db2 Database
CVE-2026-78404

6.5MEDIUM

Key Information:

Vendor

IBM
Status
Db2
Vendor
CVE Published:
12 October 2026

What is CVE-2026-78404?

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 contain a vulnerability that allows local privilege escalation through the db2pd utility. This flaw can potentially allow authorized users to gain elevated permissions, posing a significant security risk for users and organizations relying on this database system. Users are advised to apply the latest patches and security measures to mitigate the effects of this vulnerability.

Affected Version(s)

Db2 11.5.0 <= 11.5.9

Db2 12.1.0 <= 12.1.5

References

https://www.ibm.com/support/pages/node/7291612
vendor-advisorypatch

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.