CVE-2026-108910

Genius Hub omitted a cryptographic protection step

IBM · Db2 Genius Hub administration console

First documented disclosure · Review checkpoint

Summary

An authenticated user could obtain sensitive information because the console omitted a necessary cryptographic operation.

Severity and exploitation evidence

Medium · 4.3/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public disclosures do not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

IBM classifies the flaw as a missing cryptographic step and does not specify the algorithm or affected data flow.

Conditions required

A low-privilege user can reach the affected console over the network.

Potential impact

Sensitive information could be exposed. The bulletin does not name the affected information.

Affected versions and configurations

Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4 and 1.1.5.

Fix and mitigation status

IBM Db2 Genius Hub 1.1.6.

Practical next steps

Upgrade the console to IBM Db2 Genius Hub 1.1.6. IBM lists no workaround.

Operating lesson

Review cryptographic protections across every stage of a sensitive operation.

Evidence and limits

IBM’s bulletin applies its remediation to Genius Hub and Agentics. The CNA identifies the affected component as the database administration console. Its November 8 update is supplemental assessment.

Sources