CVE-2026-9762 is a code injection vulnerability in IBM Db2 affecting versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4. The vulnerability arises when an attacker can control the JDBC URL, potentially enabling remote code execution. The CVSS 3.1 vector indicates the attack requires local access with low complexity and low privileges but no user interaction, and it impacts confidentiality, integrity, and availability with high severity.

Successful exploitation of this vulnerability could allow an attacker with local access and low privileges to execute arbitrary code remotely via manipulation of the JDBC URL. This could lead to full compromise of the affected Db2 database system, including unauthorized data access, modification, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should monitor IBM's official advisories for updates and apply patches once available. Until then, restrict local access to trusted users and validate or restrict control over JDBC URL inputs to mitigate risk.