IBM Db2 Mirror CVE-2026-16905

The vulnerability affects IBM Db2 Mirror for i specifically - not Db2 for LUW or other IBM i database products - and requires that a Db2 Mirror configuration is active and reachable over the network. A key unresolved ambiguity: IBM's description states 'remote authenticated attacker,' implying valid credentials are a prerequisite, while the official CVSS PR:N rating suggests no authentication is required. This conflict must be verified with IBM before teams determine whether the attack surface includes unauthenticated network principals or only credential-holding users. Exploitation is further limited to the IBM i platform (Power Systems), which is typically deployed in controlled enterprise environments rather than internet-facing roles, reducing opportunistic attack exposure.

The CVSS base score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N signals a low-complexity, network-reachable information disclosure with no privileges required. However, IBM's natural-language description explicitly states 'remote authenticated attacker,' which directly contradicts the PR:N rating - this is a material inconsistency that cannot be resolved from available data alone. If PR:N is accurate, the exposure surface is broader (unauthenticated network access sufficient). If the description is accurate, exploitation is gated behind valid credentials, substantially reducing real-world risk. No CISA KEV listing and no confirmed public exploit code further lower operational urgency. The IBM i platform is typically deployed in controlled enterprise environments, which naturally limits internet-facing exposure. This is not a drop-everything priority, but IBM i administrators running affected mirror configurations should apply the vendor patch promptly given the authentication-bypass tag and unresolved CVSS conflict.

An attacker with network access to an IBM Db2 Mirror for i instance submits a crafted request that exploits the improper authentication check, bypassing the expected credential validation and receiving sensitive database content or configuration metadata in the response. No public exploit code is confirmed, so exploitation currently requires independent knowledge of the authentication flaw. The low attack complexity rating (AC:L) suggests that once the flaw is understood, exploitation would not require advanced techniques.