CVE-2026-15955: 
IBM Db2 脆弱性の分析と軽減

CVE-2026-15955 is an arbitrary file write vulnerability in IBM Db2's Data Server driver for JDBC and SQLJ, caused by improper validation of file paths. It affects IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, Unix, and Windows platforms. The vulnerability was disclosed on September 14, 2026, with a patch made available the same day. It carries a CVSS v3.1 base score of 7.5 (High) (IBM Advisory).

The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). The flaw resides in the IBM Data Server driver for JDBC and SQLJ, where an "evil" (malicious or compromised) server can exploit insufficient file path validation to instruct a connected client to write arbitrary files to unintended locations on the client's file system. Exploitation requires no authentication, no user interaction, and operates over the network with low attack complexity, making it automatable (IBM Advisory). Relevant attack patterns include CAPEC-126 (Path Traversal) and CAPEC-64/76/78/79 (various encoding-based bypass techniques).

Successful exploitation allows a remote attacker to write arbitrary files to the client system's file system, resulting in a high integrity impact. While confidentiality and availability are not directly affected per the CVSS scoring, arbitrary file writes can be leveraged to overwrite configuration files, plant malicious scripts, or achieve persistent access on the client host. The attack originates from a malicious or compromised Db2 server targeting any client using the vulnerable JDBC/SQLJ driver, potentially affecting all systems that connect to untrusted Db2 server instances (IBM Advisory).

As of the disclosure date, there are no known public proof-of-concept exploits, no reported in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.396%, indicating a low near-term exploitation probability. NVD's SSVC assessment notes the vulnerability is automatable but exploitation has not been observed (IBM Advisory).

1. Setup malicious server: An attacker configures a rogue IBM Db2-compatible server (or compromises a legitimate one) that can respond to JDBC/SQLJ client connections.
2. Lure client connection: The attacker tricks a victim client application using the IBM Data Server driver for JDBC and SQLJ (versions 11.5.0–11.5.9 or 12.1.0–12.1.5) into connecting to the malicious server, e.g., via a crafted JDBC connection string or DNS poisoning.
3. Send malicious file path: During the connection or data exchange, the malicious server sends a response containing a crafted file path using path traversal sequences (e.g., ../../) that bypasses the driver's path validation logic.
4. Arbitrary file write: The vulnerable JDBC/SQLJ driver writes attacker-controlled content to the traversed path on the client's file system, potentially overwriting sensitive files or planting a malicious payload (e.g., a web shell, cron job, or startup script) (IBM Advisory).

• File System: Unexpected or modified files in directories outside the intended Db2 driver working directory; new or altered configuration files, scripts, or executables with timestamps coinciding with Db2 client connection activity.
• Logs: Db2 client-side JDBC/SQLJ driver logs showing connections to unfamiliar or external Db2 server endpoints; file I/O errors or warnings related to path resolution in driver logs.
• Network: Outbound JDBC connections (default port 50000/TCP) from client hosts to unknown or external IP addresses; unusual DNS lookups for Db2 server hostnames not matching known infrastructure.

IBM has released patches addressing this vulnerability; users should upgrade the IBM Data Server driver for JDBC and SQLJ to a fixed version as detailed in the IBM advisory. Affected version ranges are 11.5.0–11.5.9 and 12.1.0–12.1.5 — users should apply the latest available fix pack. As a workaround, restrict client applications from connecting to untrusted or external Db2 server instances, and enforce network-level controls (firewalls, allowlists) to limit JDBC connections to known, trusted servers (IBM Advisory).