IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 contain an improper authorization vulnerability (CWE-285) that can be exploited by an attacker to escalate privileges by submitting a specially crafted query. The CVSS 3.1 base score is 8.2, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity but not availability. The vulnerability is publicly disclosed but no vendor advisory or patch information is currently available.

Successful exploitation could allow an unauthenticated attacker to escalate privileges on the affected IBM Db2 database, potentially leading to unauthorized access to sensitive data and modification of data integrity. Availability is not impacted. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the database and monitor for suspicious query activity related to privilege escalation attempts.