CVE-2026-14501

Estado: AnalizadaCrítica (9.8)—

IBM Db2 Genius Hub 1.1, 1.1.1, 1.1.2 and IBM Agentics 1.0 could allow an attacker to execute arbitrary code or obtain sensitive information due to the use of dangerous functions without sufficient restrictions.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 9.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.46%
Percentil entre todas las CVEs puntuadas: 38
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access95 %
Impacto principalT1059 Command and Scripting Interpreterexecution85 %
Impacto secundarioT1005 Data from Local Systemcollection80 %

Vector CVSS:3.1 con AV:N/PR:N/UI:N indica explotación remota sin privilegios (T1190). CWE-676 (dangerous functions) y descripción de 'arbitrary code execution' justifican T1059 como impacto primario; 'obtain sensitive information' sustenta T1005 como secundario.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Vulnerability Scanning Restrict Web-Based Content Network Segmentation Limit Software Installation Limit Access to Resource Over Network

Tecnologías afectadas (2)

IBM — Agentics IBM — DB2 Genius HUB

CWE

CWE-676

Referencias

https://www.ibm.com/support/pages/node/7279901

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-14501",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-14501",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-20T18:00:02.694960Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@us.ibm.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:db2_genius_hub:1.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:db2_genius_hub:1.1.0:*:*:*:*:*:*:*"
          ],
          "vendor": "IBM",
          "product": "Db2 Genius Hub",
          "versions": [
            {
              "status": "affected",
              "version": "1.1, 1.1.1, 1.1.2"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:agentics:1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:agentics:1.0.0:*:*:*:*:*:*:*"
          ],
          "vendor": "IBM",
          "product": "Agentics",
          "versions": [
            {
              "status": "affected",
              "version": "1.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-07-17T20:17:15.073",
  "references": [
    {
      "url": "https://www.ibm.com/support/pages/node/7279901",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@us.ibm.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-676"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Db2 Genius Hub 1.1, 1.1.1, 1.1.2 and IBM Agentics 1.0 could allow an attacker to execute arbitrary code or obtain sensitive information due to the use of dangerous functions without sufficient restrictions."
    }
  ],
  "lastModified": "2026-08-11T23:17:26.043",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:agentics:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "37123C5E-D6EC-4392-8951-6D7C756A9637"
            },
            {
              "criteria": "cpe:2.3:a:ibm:db2_genius_hub:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3F040F8E-5167-4EE4-A351-638ABE4D7E6C",
              "versionEndExcluding": "1.1.3",
              "versionStartIncluding": "1.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}