CVE-2026-10543 (GCVE-0-2026-10543)
Vulnerability from cvelistv5
Published
2026-08-12 20:50
Modified
2026-08-13 13:53
Severity ?
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
CWE
Summary
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query.
References
Impacted products
Vendor Product Version
IBM Db2 Version: 11.5.0   ≤ 11.5.9
Version: 12.1.0   ≤ 12.1.5
    cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:db2:12.1.5:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-10543",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T13:53:15.999423Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T13:53:30.464Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:db2:12.1.5:*:*:*:*:*:*:*"
          ],
          "product": "Db2",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "11.5.9",
              "status": "affected",
              "version": "11.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.1.5",
              "status": "affected",
              "version": "12.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This vulnerability was reported to IBM by Nicolas Verdier, Amazon."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query.\u003c/p\u003e"
            }
          ],
          "value": "IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T20:50:02.003Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7282949"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCustomers running any vulnerable affected level of an affected Program, V11.5, and V12.1, can download the security update containing the interim fix for this issue from Fix Central. These security updates are available based on the most recent level for each impacted release: V11.5.9, V12.1.4 and V12.1.5. They can be applied to any affected level of the appropriate release to remediate this vulnerability.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eRelease\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eFixed in mod pack\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eAPAR\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eDownload URL\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eV11.5\u003c/td\u003e\u003ctd\u003eTBD\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/mysupport/s/defect/aCIgJ000000EMa9/dt472016\" rel=\"nofollow\"\u003eDT472016\u003c/a\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003eSecurity Update #87984 or later for V11.5.9 available at this link:\u003cbr/\u003e\u003ca href=\"https://www.ibm.com/support/pages/node/7087189\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7087189\u003c/a\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003eV12.1\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003eTBD\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u003ca href=\"https://www.ibm.com/mysupport/s/defect/aCIgJ000000EMa9/dt472016\" rel=\"nofollow\"\u003eDT472016\u003c/a\u003e\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003eSecurity Update #87349 or later for V12.1.4 available at this link:\u003cbr/\u003e\u003ca href=\"https://www.ibm.com/support/pages/node/7267513\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7267513\u003c/a\u003e\u003c/p\u003e\u003cp\u003eSecurity Update #88454 or later for V12.1.5 available at this link:\u003cbr/\u003e\u003ca href=\"https://www.ibm.com/support/pages/node/7282633\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7282633\u003c/a\u003e\u003cbr/\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003eNote: This remediation comes with multiple changes to Db2 functionality that are outlined here:\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003ca href=\"https://www.ibm.com/docs/en/db2/12.1.x?topic=statements-transfer-ownership\" rel=\"nofollow\"\u003eTRANSFER OWNERSHIP statement\u003c/a\u003e\u003c/li\u003e\u003cli\u003e\u003ca href=\"https://www.ibm.com/docs/en/db2/12.1.x?topic=variables-miscellaneous\" rel=\"nofollow\"\u003eNew DB2_TRANSFER_OWNER_RULES and DB2_TRANSFER_ALLOW_UNHELD_AUTHS registry variables\u003c/a\u003e\u003c/li\u003e\u003cli\u003e\u003ca href=\"https://www.ibm.com/docs/en/db2/12.1.x?topic=procedure-admin-move-table-move-tables-online\" rel=\"nofollow\"\u003eADMIN_MOVE_TABLE procedure\u003c/a\u003e\u003c/li\u003e\u003cli\u003e\u003ca href=\"https://www.ibm.com/docs/en/db2/12.1.x?topic=procedure-admin-copy-schema-copy-schema\" rel=\"nofollow\"\u003eADMIN_COPY_SCHEMA procedure\u003c/a\u003e\u003c/li\u003e\u003cli\u003e\u003ca href=\"https://www.ibm.com/docs/en/db2/12.1.x?topic=views-altobj-alter-table\" rel=\"nofollow\"\u003eALTOBJ procedure\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eIBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.\u003c/p\u003e"
            }
          ],
          "value": "Customers running any vulnerable affected level of an affected Program, V11.5, and V12.1, can download the security update containing the interim fix for this issue from Fix Central. These security updates are available based on the most recent level for each impacted release: V11.5.9, V12.1.4 and V12.1.5. They can be applied to any affected level of the appropriate release to remediate this vulnerability.\n\n\n\n\n\nReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 \n\n\n\nV12.1\n\n\n\nTBD\n\n\n\n https://www.ibm.com/support/pages/node/7267513 \n\n\n\nSecurity Update #88454 or later for V12.1.5 available at this link:\n https://www.ibm.com/support/pages/node/7282633 \n\n\n\n\n\n\nNote: This remediation comes with multiple changes to Db2 functionality that are outlined here:\n\n  *   TRANSFER OWNERSHIP statement https://www.ibm.com/docs/en/db2/12.1.x \n  *   New DB2_TRANSFER_OWNER_RULES and DB2_TRANSFER_ALLOW_UNHELD_AUTHS registry variables https://www.ibm.com/docs/en/db2/12.1.x \n  *   ADMIN_MOVE_TABLE procedure https://www.ibm.com/docs/en/db2/12.1.x \n  *   ADMIN_COPY_SCHEMA procedure https://www.ibm.com/docs/en/db2/12.1.x \n  *   ALTOBJ procedure https://www.ibm.com/docs/en/db2/12.1.x \n\n\n\n\nIBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability."
        }
      ],
      "title": "IBM\u00ae Db2\u00ae is vulnerable to privilege escalation with a specially crafted query"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-10543",
    "datePublished": "2026-08-12T20:50:02.003Z",
    "dateReserved": "2026-06-01T12:41:02.957Z",
    "dateUpdated": "2026-08-13T13:53:30.464Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-10543\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-13T13:53:15.999423Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-13T13:53:21.722Z\"}}], \"cna\": {\"title\": \"IBM\\u00ae Db2\\u00ae is vulnerable to privilege escalation with a specially crafted query\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"This vulnerability was reported to IBM by Nicolas Verdier, Amazon.\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:db2:12.1.5:*:*:*:*:*:*:*\"], \"vendor\": \"IBM\", \"product\": \"Db2\", \"versions\": [{\"status\": \"affected\", \"version\": \"11.5.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"11.5.9\"}, {\"status\": \"affected\", \"version\": \"12.1.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"12.1.5\"}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Customers running any vulnerable affected level of an affected Program, V11.5, and V12.1, can download the security update containing the interim fix for this issue from Fix Central. These security updates are available based on the most recent level for each impacted release: V11.5.9, V12.1.4 and V12.1.5. They can be applied to any affected level of the appropriate release to remediate this vulnerability.\\n\\n\\n\\n\\n\\nReleaseFixed in mod packAPARDownload URLV11.5TBD https://www.ibm.com/support/pages/node/7087189 \\n\\n\\n\\nV12.1\\n\\n\\n\\nTBD\\n\\n\\n\\n https://www.ibm.com/support/pages/node/7267513 \\n\\n\\n\\nSecurity Update #88454 or later for V12.1.5 available at this link:\\n https://www.ibm.com/support/pages/node/7282633 \\n\\n\\n\\n\\n\\n\\nNote: This remediation comes with multiple changes to Db2 functionality that are outlined here:\\n\\n  *   TRANSFER OWNERSHIP statement https://www.ibm.com/docs/en/db2/12.1.x \\n  *   New DB2_TRANSFER_OWNER_RULES and DB2_TRANSFER_ALLOW_UNHELD_AUTHS registry variables https://www.ibm.com/docs/en/db2/12.1.x \\n  *   ADMIN_MOVE_TABLE procedure https://www.ibm.com/docs/en/db2/12.1.x \\n  *   ADMIN_COPY_SCHEMA procedure https://www.ibm.com/docs/en/db2/12.1.x \\n  *   ALTOBJ procedure https://www.ibm.com/docs/en/db2/12.1.x \\n\\n\\n\\n\\nIBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eCustomers running any vulnerable affected level of an affected Program, V11.5, and V12.1, can download the security update containing the interim fix for this issue from Fix Central. These security updates are available based on the most recent level for each impacted release: V11.5.9, V12.1.4 and V12.1.5. They can be applied to any affected level of the appropriate release to remediate this vulnerability.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eRelease\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eFixed in mod pack\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eAPAR\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eDownload URL\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eV11.5\u003c/td\u003e\u003ctd\u003eTBD\u003c/td\u003e\u003ctd\u003e\u003ca href=\\\"https://www.ibm.com/mysupport/s/defect/aCIgJ000000EMa9/dt472016\\\" rel=\\\"nofollow\\\"\u003eDT472016\u003c/a\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003eSecurity Update #87984 or later for V11.5.9 available at this link:\u003cbr/\u003e\u003ca href=\\\"https://www.ibm.com/support/pages/node/7087189\\\" rel=\\\"nofollow\\\"\u003ehttps://www.ibm.com/support/pages/node/7087189\u003c/a\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003eV12.1\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003eTBD\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003e\u003ca href=\\\"https://www.ibm.com/mysupport/s/defect/aCIgJ000000EMa9/dt472016\\\" rel=\\\"nofollow\\\"\u003eDT472016\u003c/a\u003e\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003eSecurity Update #87349 or later for V12.1.4 available at this link:\u003cbr/\u003e\u003ca href=\\\"https://www.ibm.com/support/pages/node/7267513\\\" rel=\\\"nofollow\\\"\u003ehttps://www.ibm.com/support/pages/node/7267513\u003c/a\u003e\u003c/p\u003e\u003cp\u003eSecurity Update #88454 or later for V12.1.5 available at this link:\u003cbr/\u003e\u003ca href=\\\"https://www.ibm.com/support/pages/node/7282633\\\" rel=\\\"nofollow\\\"\u003ehttps://www.ibm.com/support/pages/node/7282633\u003c/a\u003e\u003cbr/\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003eNote: This remediation comes with multiple changes to Db2 functionality that are outlined here:\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003ca href=\\\"https://www.ibm.com/docs/en/db2/12.1.x?topic=statements-transfer-ownership\\\" rel=\\\"nofollow\\\"\u003eTRANSFER OWNERSHIP statement\u003c/a\u003e\u003c/li\u003e\u003cli\u003e\u003ca href=\\\"https://www.ibm.com/docs/en/db2/12.1.x?topic=variables-miscellaneous\\\" rel=\\\"nofollow\\\"\u003eNew DB2_TRANSFER_OWNER_RULES and DB2_TRANSFER_ALLOW_UNHELD_AUTHS registry variables\u003c/a\u003e\u003c/li\u003e\u003cli\u003e\u003ca href=\\\"https://www.ibm.com/docs/en/db2/12.1.x?topic=procedure-admin-move-table-move-tables-online\\\" rel=\\\"nofollow\\\"\u003eADMIN_MOVE_TABLE procedure\u003c/a\u003e\u003c/li\u003e\u003cli\u003e\u003ca href=\\\"https://www.ibm.com/docs/en/db2/12.1.x?topic=procedure-admin-copy-schema-copy-schema\\\" rel=\\\"nofollow\\\"\u003eADMIN_COPY_SCHEMA procedure\u003c/a\u003e\u003c/li\u003e\u003cli\u003e\u003ca href=\\\"https://www.ibm.com/docs/en/db2/12.1.x?topic=views-altobj-alter-table\\\" rel=\\\"nofollow\\\"\u003eALTOBJ procedure\u003c/a\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eIBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.\u003c/p\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.ibm.com/support/pages/node/7282949\", \"tags\": [\"vendor-advisory\", \"patch\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-285\", \"description\": \"CWE-285 Improper Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"shortName\": \"ibm\", \"dateUpdated\": \"2026-08-12T20:50:02.003Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-10543\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-13T13:53:30.464Z\", \"dateReserved\": \"2026-06-01T12:41:02.957Z\", \"assignerOrgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"datePublished\": \"2026-08-12T20:50:02.003Z\", \"assignerShortName\": \"ibm\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.