CVE-2026-87958

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 contain a denial-of-service vulnerability (CWE-269, improper privilege management) in which a specific functionality on a Db2 server can be disabled. The flaw is triggered over the network by an authenticated user holding privileges on the Db2 server — the CVSS vector grades required privileges as low (PR:L) — and requires no user interaction, under certain conditions on the server. A successful attacker can disable that functionality, hitting availability; the 8.1 High CVSS vector also scores high integrity impact (C:N/I:H/A:H), suggesting the affected functionality can be left in a modified or disabled state. Any organization running the listed Db2 11.5.x or 12.1.x releases is potentially affected, though exploitation requires an account with privileges on the database server. There is no evidence of exploitation: the flaw is not in CISA KEV, and no public proof-of-concept is known.

What to do: Check IBM's PSIRT advisory for CVE-2026-87958 to identify the fixed fix pack or interim-fix level (not specified in the available data) and plan upgrades for all 11.5.x and 12.1.x Db2 deployments. As an interim mitigation, restrict which accounts hold administration privileges on Db2 servers and audit recent configuration changes to the affected functionality. Prioritize systems where low-privileged or shared accounts can reach the database over the network.