[UPDATE] [high] IBM DB2: Multiple vulnerabilities enable code execution

highCVE-2020-7774 CVE-2021-43138 CVE-2021-44906 CVE-2022-0536 CVE-2022-25647 CVE-2022-28948

A remote, anonymous attacker can exploit multiple vulnerabilities in IBM DB2 to execute arbitrary code, disclose information, cause a denial of service condition, or manipulate files.

CSIRTS triage

vendor: IBM product: DB2 Remote code execution Information disclosure Denial of service Path traversal

What: Multiple vulnerabilities in IBM DB2 enable arbitrary code execution, information disclosure, denial of service, and file manipulation.
Who is affected: IBM DB2 installations exposed to unauthenticated remote attackers.
Urgency: High priority; remote code execution capability and multiple attack vectors demand immediate remediation.
Action: Apply IBM DB2 security patches covering all eight CVEs as soon as possible.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch DB2

Get an email when a new DB2 advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: high
Published: 2026-08-10
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0909

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Exploitation likely imminentCVE-2020-7774EPSS puts this in the most-targeted tier (69.4% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 99.3% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2021-431383.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 88% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2021-449064.6% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 91% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2022-05361.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 67% of all EPSS-scored CVEs.
Elevated exploitation riskCVE-2022-2564712.2% 30-day exploitation probability — well above the norm. Schedule remediation this cycle. Riskier than 96% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2022-289484.0% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 90% of all EPSS-scored CVEs.
Elevated exploitation riskCVE-2022-2907832.8% 30-day exploitation probability — well above the norm. Schedule remediation this cycle. Riskier than 98% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2022-339872.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 82% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2020-7774	coverage & exploitation status	NVD · CVE.org
CVE-2021-43138	coverage & exploitation status	NVD · CVE.org
CVE-2021-44906	coverage & exploitation status	NVD · CVE.org
CVE-2022-0536	coverage & exploitation status	NVD · CVE.org
CVE-2022-25647	coverage & exploitation status	NVD · CVE.org
CVE-2022-28948	coverage & exploitation status	NVD · CVE.org
CVE-2022-29078	coverage & exploitation status	NVD · CVE.org
CVE-2022-33987	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

highexploited[NEW] [high] Atlassian Products (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, and Jira): Multiple vulnera…cert-bund
medium[UPDATE] [medium] CoreDNS: Multiple vulnerabilities enable denial of servicecert-bund
high[NEW] [high] Dell PowerProtect Data Domain: Multiple vulnerabilitiescert-bund
medium[UPDATE] [medium] Splunk Splunk Enterprise: Multiple vulnerabilities in third-party componentscert-bund

Recent advisories for IBM DB2

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-18554: IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain s…nvd · 2026-08-14
mediumCVE-2026-18178: IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to delete a…nvd · 2026-08-14
mediumCVE-2026-17227: IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass s…nvd · 2026-08-14
mediumCVE-2026-17209: IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute …nvd · 2026-08-14
criticalCVE-2026-17186: IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL c…nvd · 2026-08-14
criticalCVE-2026-17184: IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code…nvd · 2026-08-14