CVE-2026-108838

Local resource consumption could interrupt Genius Hub

IBM · Db2 Genius Hub administration console

First documented disclosure · Review checkpoint

Summary

A local user could consume enough of an affected console’s resources to impair availability.

Severity and exploitation evidence

Low · 3.3/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public disclosures do not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The product did not adequately limit resource consumption. IBM does not name the affected resource or operation.

Conditions required

IBM’s vector specifies local access and low privileges.

Potential impact

Console availability could be reduced. IBM rates the availability impact low.

Affected versions and configurations

Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4 and 1.1.5.

Fix and mitigation status

IBM Db2 Genius Hub 1.1.6.

Practical next steps

Upgrade the console to IBM Db2 Genius Hub 1.1.6. IBM lists no workaround.

Operating lesson

Enforce resource limits for local operations even when the caller is authenticated.

Evidence and limits

IBM’s bulletin applies its remediation to Genius Hub and Agentics. The CNA identifies the affected component as the database administration console. Its November 8 update is supplemental assessment.

Sources