CVE-2026-9762CWE-94

IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control

High · published July 17, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
14.8
In the wild
Unconfirmed
What it is

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00245 · 14.8th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-07-17T17:25Z
EPSS history
Timeline
  • 17 JUL 17:25Z
    IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control
    cvelistv5