CVE-2026-86087
published 2026-09-10CVE-2026-86087: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbitrary files on the…
PriorityP428medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.34%
25.1th percentile
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbitrary files on the system.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | db2 | 11.5 – 11.5.9 | — |
| ibm | db2 | 11.5.0 – 11.5.9 | — |
| ibm | db2 | 12.1.0 – 12.1.5 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbitrary files on the system.
ghsa_unreviewed·2026-09-11
CVE-2026-86087 [MEDIUM] CWE-22 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbitrary files on the system.
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbitrary files on the system.
VulDB
IBM Db2 up to 11.5.9/12.1.5 file inclusion
vuldb·2026-09-10·CVSS 4.3
CVE-2026-86087 [MEDIUM] IBM Db2 up to 11.5.9/12.1.5 file inclusion
A vulnerability was found in IBM Db2 up to 11.5.9/12.1.5. It has been declared as problematic. This vulnerability affects unknown code. The manipulation results in file inclusion.
This vulnerability is known as CVE-2026-86087. It is possible to launch the attack remotely. No exploit is available.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-10
Published