IBM Db2 RCE via User-Controlled JDBC URL (11.5.0-11.5.9,12.1.0-12.1.4)
CVE-2026-9762 Published on July 17, 2026
IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control.
Vulnerability Analysis
CVE-2026-9762 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is a Code Injection Vulnerability?
The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVE-2026-9762 has been classified to as a Code Injection vulnerability or weakness.
Products Associated with CVE-2026-9762
Want to know whenever a new CVE is published for IBM Db2? stack.watch will email you.
Affected Versions
IBM Db2:- Version 11.5.0, <= 11.5.9 is affected.
- Version 12.1.0, <= 12.1.4 is affected.