CVE-2026-10695: 
IBM Db2 vulnerability analysis and mitigation

CVE-2026-10695 is a denial-of-service vulnerability in the IBM Db2 federated server component, triggered when running non-fenced federated queries. It affects IBM Db2 versions 12.1.0 through 12.1.4 (inclusive). The vulnerability was disclosed by IBM on July 10, 2026, and published to the NVD on July 30, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) per IBM/NVD, and 6.2 (Medium) per ENISA/GitHub Advisory (IBM Advisory, GitHub Advisory).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption), meaning the Db2 federated server fails to properly control resource allocation when processing non-fenced federated queries. An authenticated local attacker with low privileges can craft or submit such queries to exhaust server resources, causing a denial of service. The attack vector is local, requires low privileges (per NVD) or no privileges (per ENISA), and no user interaction is needed. No public proof-of-concept code or detailed technical write-up has been identified at this time (IBM Advisory, GitHub Advisory).

Successful exploitation results in a high availability impact — the Db2 federated server process can be crashed or rendered unresponsive, disrupting database services for all connected users and applications. There is no confidentiality or integrity impact; the vulnerability is limited to availability. Environments relying on Db2 federated queries for cross-database or cross-system data access are most at risk of service disruption (IBM Advisory).

No active in-the-wild exploitation has been reported, and no public exploit code is known. The NVD SSVC assessment indicates exploitation is "none" and the attack is not automatable. The EPSS score is approximately 0.118% (roughly 1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (IBM Advisory, GitHub Advisory).

IBM has released a fix in Db2 version 12.1.5, which addresses this vulnerability. Users running Db2 12.1.0 through 12.1.4 should upgrade to 12.1.5 or apply the relevant IBM fix pack as described in the security bulletin. IBM Application Performance Management products bundling affected Db2 versions are also covered by a separate advisory. No configuration-based workaround has been publicly documented; upgrading is the recommended remediation (IBM Advisory, IBM APM Advisory).