IBM Db2 Mirror CVE-2026-16708

Exploitation requires a network-reachable IBM Db2 Mirror for i instance running versions 7.4, 7.5, or 7.6. The CVSS vectors AC:H and UI:R indicate two key limiting factors: the attacker must engineer specific conditions (likely involving influence over an external configuration resource, such as a network path, file share, or server the mirror process contacts), AND a legitimate user must perform some action - such as initiating a configuration load, connecting to the mirror pair, or triggering a sync event - for the malicious configuration to be consumed. Exploitation is therefore not fully passive; it depends on user-triggered activity within the Db2 Mirror management workflow. The PR:N metric confirms no prior authentication to the IBM i or Db2 Mirror system is required from the attacker's perspective, but the attacker must control or intercept an external configuration channel the product trusts.

The CVSS 8.3 score with a network attack vector (AV:N), no privilege requirement (PR:N), and high confidentiality, integrity, and availability impacts (C:H/I:H/A:H) places this in the highest tier of concern, though the high attack complexity (AC:H) and required user interaction (UI:R) meaningfully reduce the likelihood of opportunistic mass exploitation. Notably, the vendor description focuses on information disclosure, yet the CVSS vector asserts full C/I/A impact - this discrepancy is not resolved by the available data and should be verified against the IBM advisory at https://www.ibm.com/support/pages/node/7283359. EPSS data was not provided, so exploitation probability cannot be quantified. No CISA KEV listing and no public POC code exist at time of analysis, suggesting limited active exploitation. The changed scope (S:C) is the most strategically significant signal: successful exploitation could compromise not just the Db2 Mirror service but associated IBM i nodes and replicated data. Even a mid-sized industrial IT operation in sopot running IBM i for core ERP or banking workloads should treat this as a priority patch, given the potential for confidential replication traffic exposure and configuration subversion in a high-availability context. Overall: real risk for IBM i shops with Db2 Mirror deployed, but AC:H and UI:R materially limit the attack surface compared to a fully unauthenticated, low-complexity flaw.

An attacker with a network-adjacent position - or capable of influencing resources the Db2 Mirror configuration process fetches - crafts or hosts a malicious configuration source that the mirror client retrieves when an authorized user or automated process initiates a configuration operation. By controlling the external configuration input, the attacker redirects or manipulates mirror parameters, potentially exposing replication credentials, database connection strings, or mirrored data streams. No public proof-of-concept code exists, and the high attack complexity suggests exploitation requires specific timing or environmental conditions rather than a simple automated scan.