IBM DB2 Warehouse vulnerabilities

5 CVEs affecting IBM DB2 Warehouse, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-33854, published 2026-06-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-41296, published 2022-12-12. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM…
CVE-2024-54178, published 2026-06-22. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8,5.0,5.1,5.2,5.3 could allow an authenticated user to cause a denial of service when creating new databases due to…
CVE-2025-2669, published 2026-06-22. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, 5.3 could allow a privileged user to perform operations and obtain sensitive information outside of…
CVE-2023-42005, published 2024-05-29. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data 3.5, 4.0, 4.5, 4.6, 4.7, and 4.8 could allow a user with access to the Kubernetes pod, to make system calls compromising the…
CVE-2023-33854, published 2026-06-22. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, and 5.3 could allow an authenticated user to bypass client-side validation and manipulate input data…