Read the docs
TI-2026-03171 Aliases CVE-2026-3676GHSA-p4qj-fgm6-87w7

There are multiple vulnerabilities in IBM DB2 bundled with IBM Application Performance Management products.

Priority LOW 29CWE-1284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

IBM Cloud APM, Base Private 8.1.4 and IBM Cloud APM, Advanced Private 8.1.4 IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in the data query logic of the Fenced environment.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00402 34th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMCloud APM, Base Private8.1.4 – ) Interim Fix 021—No fix listedCNA
IBMCloud APM, Advanced Private8.1.4—No fix listedCNA
  • Cloud APM, Base Private VendorIBM Affected 8.1.4 – ) Interim Fix 021 Fixed in — No fix listed CNA
  • Cloud APM, Advanced Private VendorIBM Affected 8.1.4 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:ibm:cloud_application_performance_managemen:8.1.4:*:*:*:advanced_private:*:*:*8.1.4VulnerableIBM
cpe:2.3:a:ibm:cloud_application_performance_managemen:8.1.4:*:*:*:base_private:*:*:*8.1.4VulnerableIBM
  • cpe:2.3:a:ibm:cloud_application_performance_managemen:8.1.4:*:*:*:advanced_private:*:*:* Versions 8.1.4 Vulnerable ·IBM
  • cpe:2.3:a:ibm:cloud_application_performance_managemen:8.1.4:*:*:*:base_private:*:*:* Versions 8.1.4 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-3676
  2. 2026-10-03 Alias added: GHSA-p4qj-fgm6-87w7

References

Patch 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences