[UPDATE] [high] IBM DB2: Multiple vulnerabilities enable code execution

highCVE-2020-7774 CVE-2021-43138 CVE-2021-44906 CVE-2022-0536 CVE-2022-25647 CVE-2022-28948

A remote, anonymous attacker can exploit multiple vulnerabilities in IBM DB2 to execute arbitrary code, disclose information, cause a denial of service condition, or manipulate files.

CSIRTS triage

vendor: IBM product: DB2 Remote code execution Information disclosure Denial of service Path traversal

What: Multiple vulnerabilities in IBM DB2 enable arbitrary code execution, information disclosure, denial of service, and file manipulation.
Who is affected: IBM DB2 installations exposed to unauthenticated remote attackers.
Urgency: High priority; remote code execution capability and multiple attack vectors demand immediate remediation.
Action: Apply IBM DB2 security patches covering all eight CVEs as soon as possible.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch DB2

Get an email when a new DB2 advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: high
Published: 2026-08-10
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0909

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Exploitation likely imminentCVE-2020-7774EPSS puts this in the most-targeted tier (69.4% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 99.3% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2021-431383.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 88% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2021-449064.6% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 91% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2022-05361.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 68% of all EPSS-scored CVEs.
Elevated exploitation riskCVE-2022-2564712.2% 30-day exploitation probability — well above the norm. Schedule remediation this cycle. Riskier than 96% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2022-289484.0% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 90% of all EPSS-scored CVEs.
Elevated exploitation riskCVE-2022-2907832.8% 30-day exploitation probability — well above the norm. Schedule remediation this cycle. Riskier than 98% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2022-339872.4% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 83% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2020-7774	coverage & exploitation status	NVD · CVE.org
CVE-2021-43138	coverage & exploitation status	NVD · CVE.org
CVE-2021-44906	coverage & exploitation status	NVD · CVE.org
CVE-2022-0536	coverage & exploitation status	NVD · CVE.org
CVE-2022-25647	coverage & exploitation status	NVD · CVE.org
CVE-2022-28948	coverage & exploitation status	NVD · CVE.org
CVE-2022-29078	coverage & exploitation status	NVD · CVE.org
CVE-2022-33987	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

highexploited[UPDATE] [hoch] Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwa…cert-bund
unknownNCSC-2026-0325 [1.00] [M/H] Kwetsbaarheden verholpen in Atlassian productenncsc-nl
medium[UPDATE] [medium] CoreDNS: Multiple vulnerabilities enable denial of servicecert-bund
high[NEW] [high] Dell PowerProtect Data Domain: Multiple vulnerabilitiescert-bund
medium[UPDATE] [medium] Splunk Splunk Enterprise: Multiple vulnerabilities in third-party componentscert-bund

Recent advisories for IBM DB2

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

high[NEU] [hoch] IBM DB2: Mehrere Schwachstellencert-bund · 2026-09-11
highCVE-2026-87958: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service …nvd · 2026-09-10
highCVE-2026-86093: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the abil…nvd · 2026-09-10
mediumCVE-2026-86087: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to …nvd · 2026-09-10
mediumCVE-2026-17483: IBM Db2 Mirror for i 7.4, 7.5, and 7.6 IBM i could allow a local attacker to delete historical…nvd · 2026-09-04
mediumCVE-2026-16660: IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of serv…nvd · 2026-09-04