CVE-2026-18097

Published Aug 12, 2026

Last updated 15 days ago

Overview

Description
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files.
Source
psirt@us.ibm.com
NVD status
Analyzed
Products
db2

Risk scores

CVSS 3.1

Type
Secondary
Base score
5.5
Impact score
3.6
Exploitability score
1.8
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity
MEDIUM

Weaknesses

psirt@us.ibm.com
CWE-532

Social media

Hype score
Not currently trending

Configurations

References

Sources include official advisories and independent security research.