Db2 Mirror for i CVE-2026-16879

The attacker must possess a valid, authenticated account on the IBM i system with at least low-level privileges - the CVSS PR:L metric confirms authentication is required. Access must be available over a network path to the Db2 Mirror for i service on the target IBM i system (AV:N). No user interaction from a victim is required (UI:N). The description specifies that the bypass occurs via user-supplied input, implying the vulnerable code path is reachable through normal authenticated interactions with the Db2 Mirror interface. What limits exploitation: an attacker without any valid credentials cannot exploit this remotely; environments that restrict Db2 Mirror service access to trusted administrative networks or specific user profiles significantly reduce the realistic attack surface. No special non-default configuration is described as a prerequisite.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) scores 8.8, reflecting a realistic and serious threat: the attack requires only network access and a low-privilege authenticated account, with no user interaction and low complexity. The full triad impact (C:H/I:H/A:H) indicates an attacker who successfully exploits this could read sensitive mirrored data, alter records, or disrupt replication availability. No EPSS data was provided in the input, and the vulnerability does not appear in the CISA KEV catalog, suggesting no confirmed widespread active exploitation at time of analysis. No public proof-of-concept code has been identified. The requiring of authenticated access (PR:L) meaningfully reduces the exposed attack surface compared to unauthenticated flaws - exploitation is contingent on an attacker already possessing valid credentials, whether obtained through credential theft, insider threat, or brute force. Overall, this is a genuine high-priority issue for IBM i environments running the affected Db2 Mirror versions, particularly those where Db2 Mirror is accessible over the network to users with varied privilege levels.

An attacker with a valid low-privilege IBM i user account sends a crafted request to Db2 Mirror for i over the network, embedding manipulated user-supplied input designed to influence the authorization decision. The improper authorization logic accepts the crafted input and grants access beyond the user's assigned role, enabling the attacker to read, modify, or delete mirrored database content. No public proof-of-concept code has been identified, but the low attack complexity (AC:L) means that once an exploitation technique is understood, it requires no specialized conditions to replicate.