CVE-2026-110283

Resource identifiers could disrupt Genius Hub availability

IBM · Db2 Genius Hub administration console

First documented disclosure · Review checkpoint

Summary

An authenticated console user could impair availability through an improperly validated resource identifier.

Severity and exploitation evidence

Medium · 4.3/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public disclosures do not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The console accepted user-influenced resource identifiers without enough validation before using them.

Conditions required

An authenticated low-privilege user can reach the affected console over the network.

Potential impact

The console could experience a denial of service. IBM rates the availability impact low.

Affected versions and configurations

Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4 and 1.1.5.

Fix and mitigation status

IBM Db2 Genius Hub 1.1.6.

Practical next steps

Upgrade the console to IBM Db2 Genius Hub 1.1.6. IBM lists no workaround.

Operating lesson

Validate resource identifiers before they reach operations that consume or reserve resources.

Evidence and limits

IBM’s bulletin applies its remediation to Genius Hub and Agentics. The CNA identifies the affected component as the database administration console. Its November 8 update is supplemental assessment.

Sources