CVE-2026-10109 is a critical vulnerability in IBM Db2 affecting versions 11.5.0 and 12.1.0. It arises from improper control of code generation (CWE-94) during the pre-authentication DRDA handshake process, enabling remote code execution without requiring user interaction or privileges. The vulnerability has a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability allows a remote unauthenticated attacker to execute arbitrary code on the affected IBM Db2 server. This can lead to full compromise of the database system, including unauthorized data access, modification, or denial of service. The vulnerability impacts confidentiality, integrity, and availability at the highest level.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting network access to the Db2 service, especially from untrusted networks, and monitor for unusual activity related to DRDA handshake attempts. No vendor-provided mitigation or temporary fix is currently documented.