EUVD-2026-71488
GHSA-v392-pm9q-f3mc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Unauthenticated network-accessible OOB read with no confidentiality or integrity impact, only partial availability disruption, aligns with IBM's own vector.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
AnalysisAI
Out-of-bounds read in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables a remote unauthenticated attacker to cause a denial of service by sending a crafted network request to the mirroring service. The flaw (CWE-125) is exploitable with no authentication or user interaction and can disrupt high-availability replication continuity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required - the CVSS vector AV:N/AC:L/PR:N/UI:N indicates remote unauthenticated exploitation against default configurations of IBM Db2 Mirror for i 7.4, 7.5, and 7.6. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 Medium rating is grounded in a fully unauthenticated, low-complexity network attack path (AV:N/AC:L/PR:N/UI:N) with limited availability impact (A:L) and no confidentiality or integrity exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | IBM has released a patch addressing this vulnerability; administrators should consult the IBM advisory at https://www.ibm.com/support/pages/node/7285904 to obtain the specific PTF (Program Temporary Fix) identifiers for affected versions 7.4, 7.5, and 7.6 and apply them through the IBM i fix management process. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Db2 Mirror For I
View allOS command injection in IBM Db2 Mirror for i (releases 7.4, 7.5, and 7.6) lets a remote, unauthenticated attacker execut
Remote code execution in IBM Db2 Mirror for i (versions 7.4, 7.5, and 7.6) allows a remote unauthenticated attacker to r
Authentication bypass in IBM Db2 Mirror for i (versions 7.4, 7.5, and 7.6) lets a remote, unauthenticated attacker read
Remote CL command execution in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 lets a remote attacker run arbitrary Control Langu
Security restriction bypass in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 permits remote authenticated attackers to exceed t
Arbitrary file write via path traversal in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 enables remote unauthenticated attacke
Arbitrary file deletion in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 is achievable by remote authenticated attacke
Sensitive file disclosure in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 is possible through a path traversal flaw (
Path traversal in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote authenticated attackers to read sensiti
Arbitrary file write via path traversal in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes systems to unauthenti
Uncontrolled recursion in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote unauthenticated attackers to cr
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes a network-accessible pathway through which an unauthenticated re
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today