CVE-2026-16480 is a medium severity (CVSS 4.3) improper authorization flaw in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5. A non-privileged user can bypass authority checks through a certain command and modify database catalog data. IBM provides interim security updates through Fix Central.
What's affected
IBM Db2 for Linux, UNIX and Windows, versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5, server editions, on all platforms. That matches the NVD record.
IBM's bulletin says the fix ships as security updates that can be applied to any affected level of the release, built on the most recent level of each: V11.5.9, V12.1.4 and V12.1.5. The listed updates are Security Update 87984 or later for V11.5.9, 86025 or later for V12.1.4, and 88454 or later for V12.1.5. The bulletin gives the APAR as DT474728 and lists the mod pack that will include the fix as TBD. IBM does not disclose which command is involved.
How to check if you're exposed
On each Db2 server, report the installed level:
db2level
Compare the result with the ranges above. Then check whether one of the security updates named in IBM's bulletin is installed on top of your level. If you have no record of applying them, assume you are exposed.
Remember that the flaw needs a signed-in user, so also review which accounts can connect to each database and whether any are broader than they need to be.
What to do now
- Run db2level on every instance and note the release.
- Download the matching security update from Fix Central using the links in IBM's bulletin 7282951.
- Apply it to a test instance, then to production, following IBM's install guidance.
- Review the list of database users and drop unused ones.
- Check the bulletin again later for the mod pack that will carry the fix permanently.
Why it matters
The record maps this to CWE-602, client-side enforcement of server-side security. In plain terms, a check that decides whether someone may do something is not enforced where it matters, so a command can slip past the authority test. IBM keeps the specifics private on purpose to avoid helping attackers.
The score is modest because the effect is limited to low integrity impact on catalog data, and the attacker needs a login. Still, the catalog describes your tables, privileges and routines. Unplanned edits there can confuse audits and later cause larger problems, so schedule the update with normal priority rather than ignoring it.
The weakness class here is CWE-602 (Client-Side Enforcement of Server-Side Security). The NVD record scores it 4.3, which is medium severity. IBM's bulletin gives the same score. The CVSS vector reads attack vector over the network, low attack complexity, low privileges required, no user interaction. Scope is unchanged. Impact on confidentiality, integrity and availability is rated low, none and none. The record's KEV flag is false, so this CVE is not in CISA's Known Exploited Vulnerabilities catalog, and the advisory I fetched does not report exploitation.
Safeguard's Gold directory tracks this CVE, and reachability analysis helps you decide which affected components matter most for your own software.
Quick check
Why is a 4.3 worth patching?
The score reflects limited direct impact, but the catalog controls how the database behaves. A user who should not change it can create problems that show up later. Bulletin updates are cheap compared with cleaning up catalog changes.
Sources
- IBM security bulletin for Db2
- Safeguard Gold entry for CVE-2026-16480, which summarizes the NVD record
Last reviewed: 18 October 2026.
