Vulnerabilities

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 contain a denial-of-service vulnerability (CWE-269, improper privilege management) in which a specific functionality on a Db2 server can be disabled. The flaw is triggered over the network by an authenticated user holding privileges on the Db2 server — the CVSS vector grades required privileges as low (PR:L) — and requires no user interaction, under certain conditions on the server. A successful attacker can disable that functionality, hitting availability; the 8.1 High CVSS vector also scores high integrity impact (C:N/I:H/A:H), suggesting the affected functionality can be left in a modified or disabled state. Any organization running the listed Db2 11.5.x or 12.1.x releases is potentially affected, though exploitation requires an account with privileges on the database server. There is no evidence of exploitation: the flaw is not in CISA KEV, and no public proof-of-concept is known.

Do: Check IBM's PSIRT advisory for CVE-2026-87958 to identify the fixed fix pack or interim-fix level (not specified in the available data) and plan upgrades for all 11.5.x and 12.1.x Db2 deployments. As an interim mitigation, restrict which accounts hold administration privileges on Db2 servers and audit recent configuration changes to the affected functionality. Prioritize systems where low-privileged or shared accounts can reach the database over the network.

IBM DataStage running on Cloud Pak for Data version 5.4.0.0 contains an improper authentication flaw (CWE-287) rated critical with a CVSS 3.1 score of 9.6. A remote attacker who already possesses valid low-privilege credentials can trigger the flaw over the network with no user interaction, exploiting a scope change to reach resources beyond the component's normal security boundary. Successful exploitation allows the attacker to obtain sensitive information and bypass security restrictions, causing high impact to both confidentiality and integrity, though availability is not affected. Organizations running self-managed IBM DataStage 5.4.0.0 on Cloud Pak for Data deployments are the affected population. No public proof-of-concept is known, the issue is not on the CISA KEV list, and there is no evidence of exploitation in the wild.

Do: Upgrade IBM DataStage on Cloud Pak for Data 5.4.0.0 to the fixed release specified in IBM's security bulletin as soon as it is available, and verify any interim fixes IBM publishes. Restrict network access to DataStage service endpoints to trusted users and networks, and apply least-privilege role assignments since exploitation requires only low-privilege authenticated access. Review authentication and audit logs for anomalous authenticated activity and unexpected access to sensitive data.

IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.7 ship with default administrative credentials that are not forced to be changed. A remote attacker who can reach the gateway's management interface over the network can authenticate with these default credentials without any user interaction or prior privileges, gaining full administrative control of the gateway. Because the product brokers Model Context Protocol traffic between AI agents and backend tools/services, an attacker with admin access could reconfigure routing, access downstream connection details and credentials, and tamper with tool invocations. The issue carries a critical CVSS 3.1 score of 9.8, but there is no known public proof of concept and no evidence of exploitation in the wild to date.

Do: Upgrade ContextForge MCP Gateway to the latest release from IBM (anything after 1.0.7, per IBM's advisory) and immediately replace the default administrative credentials if an upgrade cannot be applied right away. Restrict network access to the gateway's admin interface (VPN, allowlist, or internal-only placement) and verify no unauthenticated-origin admin logins appear in gateway logs. Because admin access can expose downstream tool connections, rotate any API keys, tokens, or service credentials configured on affected gateways.

IBM App Connect Enterprise, an enterprise integration and messaging middleware product, is affected by an incorrect authorization flaw (CWE-863) in versions 13.0.1.0 through 13.0.8.1 and 12.0.1.0 through 12.0.12.27. The issue can be triggered remotely by any authenticated user who sends a request to functionality where the product fails to correctly enforce its authorization checks, with no user interaction or special conditions required (CVSS AV:N/AC:L/PR:L/UI:N). An attacker who successfully exploits it can bypass security restrictions and gain unauthorized access to protected operations and data, with IBM scoring the potential impact as high on confidentiality, integrity, and availability (CVSS 3.1 score 8.8). All customers running the affected version ranges of App Connect Enterprise are exposed to risk, though exploitation requires a valid account on the system. No public proof-of-concept is known, the flaw is not in the CISA KEV catalog, and there are no reports of exploitation in the wild.

Do: Check the IBM PSIRT advisory for CVE-2026-75624 and upgrade App Connect Enterprise to the fixed fix-pack/release levels for the 12.x and 13.x streams (any release beyond the listed ranges per IBM's guidance). Until patched, limit network reachability of ACE nodes, review and tighten authenticated user accounts and role/permission assignments that could be abused by the authorization bypass, and monitor logs for authenticated users accessing resources outside their normal scope.

IBM WebSphere Application Server 8.5 and 9.0 suffer from an improper privilege management flaw (CWE-269) in which an authenticated user holding a low-privilege administrative role can modify the server's security configuration. The flaw is triggered through normal administrative access to the WebSphere administrative console or related admin interfaces, after valid authentication. A successful attacker can abuse this to expose sensitive information or cause denial of service, reflected in the CVSS 3.1 base score of 8.1 (high) with high confidentiality and availability impact. Any deployment of WebSphere Application Server 8.5 or 9.0 that grants administrative roles beyond fully trusted operators is affected. There is no known public proof of concept, the CVE is not on the CISA KEV list, and no in-the-wild exploitation has been reported.

Do: Apply IBM's fix for this vulnerability (latest fix pack/interim fix per the IBM security bulletin) to all WebSphere Application Server 8.5 and 9.0 deployments. Restrict administrative console access to trusted networks and limit assignment of low-privilege administrative roles to only necessary users. Audit existing admin role assignments and review security configuration change logs for unauthorized modifications.