IBM vulnerabilities, week 37 of 2026: two high-severity Db2 flaws and five WebSphere CVEs

The release at a glance

IBM's vulnerability set for week 37 of 2026 (7 September to 13 September) contains eight CVEs across two products: five for WebSphere Application Server and three for Db2. Two are rated high and six medium. No CVE in this release is marked exploited, and none appears in CISA KEV.

The two high-severity items are both in Db2. CVE-2026-87958 is a denial-of-service condition in which a low-privilege user can disable a specific server functionality under certain conditions. CVE-2026-86093 is a stack-based buffer overflow in the federated server that could allow an attacker who controls or impersonates a DRDA server endpoint to execute arbitrary commands on Db2 clients.

What matters most

Db2 has three CVEs.

CVE-2026-87958 (CVSS 8.1, high) affects Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5. A low-privilege user can disable a specific server function over the network, with integrity and availability impact.

CVE-2026-86093 (CVSS 7.5, high) affects the same Db2 version ranges. It is a stack-based buffer overflow in the federated server; an attacker able to control or impersonate a DRDA server endpoint could execute arbitrary commands on Db2 clients. The technical impact is total, though attack complexity is high.

CVE-2026-86087 (CVSS 4.3, medium) also affects those Db2 versions. An authenticated user could send a specially crafted request to write arbitrary files on the system.

WebSphere Application Server has five CVEs, all addressed by moving to WebSphere Application Server 9.0.5.29 or 8.5.5.31.

CVE-2026-9176 (CVSS 6.7, medium) is a local security bypass involving improper authentication controls, allowing privilege escalation and unauthorised access to protected resources.

CVE-2026-9336 (CVSS 6.5, medium) is a denial of service caused by a specially crafted HTTP request to an administrative endpoint that can exhaust filesystem space.

CVE-2026-9327 (CVSS 6.3, medium) allows an authenticated user with a low-privilege administrative role to modify security configuration, potentially leading to information disclosure or denial of service.

CVE-2026-9338 (CVSS 5.3, medium) is a remote, unauthenticated denial of service triggered by a specially crafted request that causes excessive resource consumption; IBM's SSVC assessment marks it as automatable.

CVE-2026-9667 (CVSS 5.3, medium) is a server-side request forgery that could allow a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints.

Patch in this order

1. Patch Db2 first. CVE-2026-87958 and CVE-2026-86093 have the highest scores in this release and affect Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5. The advisory does not name fixed versions for Db2, so obtain the current fix pack from IBM's support pages. Include CVE-2026-86087 in the same Db2 patch cycle.

1. Patch WebSphere Application Server 9.0 to 9.0.5.29 and 8.5 to 8.5.5.31. This addresses all five WebSphere CVEs, including the remote unauthenticated denial-of-service and SSRF issues.

1. If patching WebSphere cannot happen immediately, restrict network access to administrative endpoints and prioritise internet-facing deployments, because CVE-2026-9338 and CVE-2026-9667 are reachable over the network without credentials. No CISA KEV due date applies because no CVE in this release is listed in KEV.

Beyond the patch

A week with no exploited or KEV-listed flaws is a prioritisation exercise rather than an emergency, but several WebSphere issues are reachable without credentials and the Db2 high-severity items carry broad integrity and availability impact. Virtual CISO Services helps keep internet-facing WebSphere deployments and administrative endpoints visible and prioritised, while Managed Detection & Response can watch for code execution and privilege-escalation activity tied to this class of issue.