IBM Db2 Releases Face Privilege Escalation Risk

IBM Db2 versions 11.5.0–11.5.9 and 12.1.0–12.1.5 allow privilege escalation through a specially crafted query. CVE-2026-10543 carries a CVSS 3.1 score of 8.2 high, stems from improper authorization (CWE-285), and was published August 12, 2026. An IBM advisory is available.

Source:NVD

Post

IBM Db2 Releases Face Privilege Escalation Risk

TL;DRAI · 60 sec read

Versions of IBM Db2 from 11.5.0 to 11.5.9 and from 12.1.0 to 12.1.5 can allow attackers to escalate privileges by using a specially crafted query.

A high-severity CVE has been published. The National Vulnerability Database added CVE-2026-10543 to its records on August 12, 2026. IBM Corporation supplied the initial information to the CVE List that same day at 5:17:34 PM.

IBM rates the issue with a CVSS 3.1 base score of 8.2, classified as high. The assigned vector string reads CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N.

The flaw enables privilege escalation. According to the submitting organization, the product "is vulnerable to privilege escalation with a specially crafted query." It maps to CWE-285, labeled as improper authorization.

From The CircuitryThe Feed — live briefs across tech, all day.See what’s happening →

The impacted releases span 11.5.0 through 11.5.9 inclusive and 12.1.0 through 12.1.5 inclusive. Corresponding Common Platform Enumeration strings mark these exact version ranges as affected.

IBM has published an advisory. Guidance appears at https://www.ibm.com/support/pages/node/7282949. IBM Corporation added this link when the record was first created.

NIST has not yet supplied any CVSS 4.0 or CVSS 2.0 evaluation. NVD enrichment efforts state that assessment remains unavailable for those scoring versions.

EXPERT TAKE

Enterprise database administrators running affected Db2 releases should review the IBM support page immediately and apply any available patches or mitigations.

Why this mattersAI · ~100 words

Tap a lens to see what this story means for you.

Reader-supported

DonateBuy me a coffee →Follow@thecircuitry_ →Follow@thecircuitry.to →

Reader-supported · The Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning. Two minutes, free forever.

HELP US IMPROVE

Reader-supported

The Circuitry is a passion project I've always wanted to build, and I love the work behind it.

Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.

Any contribution is appreciated. If not, no pressure. Thanks for reading.

Buy me a coffee

security vulnerability database

MORE IN TECH

Apple raises prices $100 across every remaining previous-generation iPhone

Apple has raised prices by $100 on the iPhone 16, full iPhone 17 lineup and iPhone Air immediately after unveiling the iPhone Duo and iPhone 18 Pro, according to tipster reports. The move means an affordable iPhone now costs more than it did yesterday.

Apple Launches Its C2 Cellular Modem Alongside iPhone Duo

Apple introduced the C2 modem with the iPhone Duo announcement, promising up to 50% faster uploads, 15% lower power consumption, and mmWave support in the US. Fully integrated with the A20 Pro and iOS 27, the platform uses AI algorithms to strengthen connection reliability in weak signal areas.

Windows 10 1607 DHCP Server Hit by CVSS 8.0 Vulnerability

Microsoft disclosed CVE-2026-69412, an 8.0-rated stack-based buffer overflow in Windows DHCP Server that lets an authenticated attacker execute code over an adjacent network, affecting Windows 10 1607. Patches are available while exploitation remains unlikely with no known attacks reported.