CVE-2026-78404 MEDIUM

CVE-2026-78404: IBM® Db2® is vulnerable to local privilege escalation via the db2pd utility

Vendor Ibm
Product Db2
Weakness CWE-269
Published October 12, 2026
Last update October 13, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility.

Key dates

02Disclosure timeline

October 12, 2026 CVE published
October 13, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-7467 Read More & Accordion <= 3.5.7 - Privilege Escalation via importData CVE-2026-6228 Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form CVE-2026-4880 Barcode Scanner (+Mobile App) <= 1.11.0 - Unauthenticated Privilege Escalation via Insecure Token Authentication CVE-2026-8719 AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token CVE-2026-8206 Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'