What’s Vulnerable › Vulnerabilities
CVE-2023-33854: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-22 · updated 2026-09-26
- Weakness: CWE-294
Description
IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, and 5.3 could allow an authenticated user to bypass client-side validation and manipulate input data using man in the middle techniques.
Affected products
- IBM Db2 for Linux, UNIX and Windows: from 4.8 before 5.4 — fixed in 5.4
- IBM Db2 Warehouse: from 4.8 before 5.4 — fixed in 5.4
How to fix
Upgrade to a fixed version: IBM Db2 for Linux, UNIX and Windows 5.4; IBM Db2 Warehouse 5.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2023-33854 or the next vulnerability affects your stack