IBM Db2 Path Traversal CVE-2026-86087: Authenticated RFI, CVSS 4.3

IBM Db2 Security Bulletin Summary (CVE-2026-86087) Vulnerability Overview CVE ID: CVE-2026-86087 Vulnerability Type: Path Traversal (CWE-22: Improper Limitation of Pathname to a Restricted Directory) Impact Description: An authenticated user can send a crafted request to write arbitrary files on the system. CVSS Score: 4.3 (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Source: IBM Scope of Impact Affected Products and Versions: - IBM Db2 11.5.0 – 11.5.9 (Server) - IBM Db2 12.1.0 – 12.1.5 (Server) Affected Platforms: All platforms are affected (Windows, AIX, Linux, Linux on IBM Z Systems) Software Versions: 11.5.9, 12.1.5 Document ID: 7286985 Release Date: September 10, 2026 Remediation Customers running affected versions (V11.5 and V12.1) can download the security update containing the interim fix from Fix Central: - V11.5: Install security update I90467 or higher (for 11.5.9) - V12.1: Install security update I91310 or higher (for 12.1.4), or I89304 or higher (for 12.1.5) These updates can be applied to any affected version to resolve the vulnerability. IBM did not disclose specific Db2 features, but provided several non-identical remediation steps for the vulnerability to avoid giving potential attackers excessive information. Additional Information Workarounds: None Discoverer: Dan Gardner (Amazon) Reference Links: - Full CVSS v3 Guide - Online Calculator v3 - IBM Security Engineering Web Portal - IBM Product Security Incident Response Blog - Published security update information for DB2 on Linux, UNIX, and Windows

Goal Reached Thanks to every supporter — we hit 100%!

IBM Db2 Path Traversal CVE-2026-86087: Authenticated RFI, CVSS 4.3

More from this source