CVE-2026-10109 affects IBM Db2 database versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4. The vulnerability arises from improper handling of the Distributed Relational Database Architecture (DRDA) handshake before authentication, which can be exploited remotely to execute arbitrary code on the affected system. This is a code injection vulnerability categorized under CWE-94. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild as of the publication date.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the affected IBM Db2 server. This could lead to full compromise of the database server, including unauthorized data access, modification, or destruction, and disruption of database availability.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting network access to the Db2 service, especially from untrusted networks, and monitor for unusual activity related to DRDA handshake attempts. Follow IBM's official communications for updates on patches or mitigations.