CVE-2026-10543 is a high severity (CVSS 8.2) improper authorization flaw in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 that allows privilege escalation with a specially crafted query. IBM ships a security update for each release. Apply it and read the notes on changed behavior first.
What's affected
IBM's bulletin lists Db2 server 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on all platforms.
The fix is a security update on the most recent level of each release: security update 87984 or later for V11.5.9, 87349 or later for V12.1.4 and 88454 or later for V12.1.5, tied to APAR DT472016. IBM lists no workarounds.
The remediation changes Db2 behavior in several areas, and the bulletin lists them: the TRANSFER OWNERSHIP statement, two new registry variables (DB2_TRANSFER_OWNER_RULES and DB2_TRANSFER_ALLOW_UNHELD_AUTHS), and the ADMIN_MOVE_TABLE, ADMIN_COPY_SCHEMA and ALTOBJ procedures.
How to check if you're exposed
Check the Db2 level on every instance and client:
db2level
Compare the result with the range in the bulletin: 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5. Note the fix pack and any interim fix already applied, and list every server and client install, including those on build servers and in containers.
What to do now
- Read IBM's notes on the behavior changes, then test the update on a non-production instance first.
- Apply the security update for your release, using the links in the bulletin.
- Check any scripts that use TRANSFER OWNERSHIP, ADMIN_MOVE_TABLE, ADMIN_COPY_SCHEMA or ALTOBJ, since their behavior may change.
- Review database authorities and grants, and remove ones that are no longer needed.
- IBM lists no workarounds, so schedule the update.
Why it matters
The record classes this as CWE-285 (improper authorization): the database does not check that the user is allowed to do what a particular query asks. A low privileged account could then do something reserved for a more privileged one.
The vector is network based with no privileges listed and a high integrity impact. IBM gives no more detail, in line with its policy of not describing how to reproduce an issue.
The changes to ownership transfer in the fix show where the weakness sits. Treat any wide set of grants on a database as part of the risk, because privilege escalation bugs reward attackers who start with a little access.
The record does not report exploitation in the wild, and the KEV flag is false.
Quick check
Will the update change how my scripts work?
IBM says the remediation comes with multiple changes to Db2 functionality, and lists the affected statements, registry variables and procedures. Test them before you roll the update out.
Sources
Last reviewed: 19 October 2026.
