LiveActive security incident?Get immediate response
CVE Record

CVE-2023-27558: IBM Db2 privilege escalation

IBM Db2 on Windows 10.5, 11.1, and 11.5 may be vulnerable to a privilege escalation caused by at least one installed service using an unquoted service path. A local attacker could exploit this vulnerability to gain elevated privileges by inserting an executable file in the path of the affected service. IBM X-Force ID: 249194.

HighCVSS 8.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

IBM Db2 for Windows has a high-severity local privilege escalation risk. A weakness in how at least one Windows service path is installed could let someone with local access gain higher privileges on affected Db2 hosts. This is primarily a server hardening and endpoint exposure issue, not a remote internet-entry vulnerability.

Executive priority

Treat as a high-priority hardening and patch-management item for Windows database servers. It is not evidenced as actively exploited in the provided sources, but successful abuse could convert limited local access into full compromise of a Db2 host.

Technical view

CVE-2023-27558 affects IBM Db2 for Windows versions 10.5, 11.1, and 11.5. The reported issue is an unquoted service path in at least one installed service, enabling local privilege escalation if an attacker can place an executable in the relevant path. CVSS is 8.4 with local attack vector and high confidentiality, integrity, and availability impact.

Likely exposure

Organizations running IBM Db2 for Windows versions 10.5, 11.1, or 11.5 are the relevant population. Exposure is highest where local users, service accounts, or compromised workloads can interact with affected Windows hosts or writable service-path directories.

Exploitation context

The bundle does not show CISA KEV listing or cited evidence of active exploitation. Exploitation requires local access, but CVSS records low complexity and no privileges required. The business risk is post-access privilege escalation on database infrastructure.

Researcher notes

Evidence is limited to the CVE description, IBM/X-Force references, and NetApp advisory link. The source bundle does not provide CWE mapping, exploit status, or exact fixed build details. Validate against IBM’s advisory before declaring remediation complete.

Mitigation direction

  • Review IBM advisory for fixed levels, interim fixes, or vendor-specific guidance.
  • Prioritize remediation for shared Windows servers and systems hosting sensitive databases.
  • Restrict local access to Db2 hosts to trusted administrators only.
  • Harden filesystem permissions on Db2 installation and service-path directories.
  • Track downstream vendor guidance, including NetApp advisory relevance.

Validation and detection

  • Inventory Db2 for Windows installations and versions across managed endpoints and servers.
  • Compare discovered versions against IBM advisory scope and fix guidance.
  • Inspect Db2 Windows service definitions for unquoted executable paths.
  • Review directory permissions along service paths for non-admin write access.
  • Check endpoint logs for suspicious local privilege changes on Db2 hosts.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Privilege behavior lookup

The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2023-27558 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.4 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.4CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.55.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

8.4High
CVSS 3.1 vector shape for CVE-2023-27558Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
IBMDb2 for Windows10.5, 11.1 ,11.5unaffected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.