CVE-2026-14501 affects IBM Db2 Genius Hub 1.1, 1.1.1 and 1.1.2 and IBM Agentics 1.0, rated 4.3 (medium). IBM says the use of dangerous functions without sufficient restrictions could allow code execution or exposure of sensitive information. IBM's remedy is to upgrade to Db2 Genius Hub 1.1.3.
What's affected
- Products: IBM Db2 Genius Hub 1.1, 1.1.1 and 1.1.2, and IBM Agentics 1.0.
- Fixed: upgrade to IBM Db2 Genius Hub 1.1.3. IBM's remediation table covers both products under that upgrade.
- Bulletin: published 13 July 2026. It is mainly a list of third party dependency vulnerabilities, and this CVE is one of the entries.
- Severity: 4.3 with the record's CWE-676 (use of potentially dangerous function). Not on the CISA Known Exploited Vulnerabilities list. IBM lists no workarounds.
How to check if you're exposed
Check the product version in the administration interface or the deployment record. Look for Db2 Genius Hub 1.1, 1.1.1 or 1.1.2, and Agentics 1.0. If you deployed through containers or an orchestrator, check the image tag.
The bulletin lists many open source packages used inside the product, so also run a dependency scan of what you can see. The free in-browser scan at gold.safeguard.sh/scan accepts a manifest and lists known vulnerabilities by package.
What to do now
- Find installations of Db2 Genius Hub and Agentics and record their versions.
- Upgrade to Db2 Genius Hub 1.1.3 using the link in IBM's bulletin.
- Review the other CVEs listed in the same bulletin and confirm the upgrade covers them.
- Limit who can reach the product and what data it can see until the upgrade is done.
Why it matters
The weakness is CWE-676, use of a potentially dangerous function. Some functions in programming languages can run code or touch data in ways that are hard to make safe. Using one is not a bug by itself. The problem is using one without limits on what it can be asked to do.
IBM's wording is general, so the CVSS score of 4.3 is the best summary of the practical risk: lower than most entries in this series, probably because the vector requires conditions. It is still worth tracking, since the fix is a straightforward upgrade.
Quick check
Does the upgrade cover Agentics too?
IBM's remediation table lists Db2 Genius Hub and Agentics together with the upgrade to Db2 Genius Hub 1.1.3.
Is this urgent?
The score is medium and the record is not in the CISA Known Exploited Vulnerabilities catalog. Schedule it with normal patching.
Sources
Last reviewed: 19 October 2026.
