CVE-2010-3475: IBM DB2 9.7 before FP3 does not properly enforce privilege requirements for execution of entries in the dyn...

Security readout for executives and security teams

IBM DB2 9.7 before Fix Pack 3 could let a logged-in remote database user bypass intended permissions and run an UPDATE statement through cached dynamic SQL. The main business risk is unauthorized data modification by someone who already has database access. Exposure appears limited to IBM DB2 9.7 installations before FP3, especially where non-administrative users can authenticate remotely to the database and compiled compound SQL statements are used or cached. Prioritize remediation for legacy DB2 9.7 systems containing sensitive or business-critical data. The issue is not reported as actively exploited, but it affects data integrity and involves a vendor-fixed access-control bypass. Mitigation focus: Upgrade IBM DB2 9.7 to Fix Pack 3 or later per IBM guidance.; Review IBM APAR IC70406 and IBM support advisory details.; Restrict remote DB2 access to trusted users and networks..

Prepared

Jun 28, 2026, 01:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.