Customers running any vulnerable affected level of an affected Program, V11.5, and V12.1, can download the security update containing the interim fix for this issue from Fix Central. These security updates are available based on the most recent level for each impacted release: V11.5.9, V12.1.4, and V12.1.5. They can be applied to any affected level of the appropriate release to remediate this vulnerability.

Release

Fixed in mod pack

APAR

Download URL

V11.5

TBD

DT499774

Security Update #94236 or later for V11.5.9 available at this link:
https://www.ibm.com/support/pages/node/7087189

V12.1

TBD

DT499774

Security Update #94722 or later for V12.1.4 available at this link:
https://www.ibm.com/support/pages/node/7267513

Security Update #94858 or later for V12.1.5 available at this link:
https://www.ibm.com/support/pages/node/7282633

IBM does not disclose key Db2 functionality nor replication steps for a vulnerability to avoid providing too much information to any potential malicious attacker. IBM does not want to enable a malicious attacker with sufficient knowledge to craft an exploit of the vulnerability.

CVE-2026-78404

References