What is the CVSS score of CVE-2026-16905?

CVE-2026-16905 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Is there a patch available for CVE-2026-16905?

Yes, a patch is available for CVE-2026-16905. Update the affected software to the latest version immediately.

IBM Db2 Mirror CVE-2026-16905

EUVD-2026-58794 MEDIUM

Improper Authentication (CWE-287)

2026-08-14 ibm

GHSA-j7xj-v45c-v97f

Authentication Bypass IBM Db2 Mirror For I

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

MEDIUM

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.3 MEDIUM

IBM's description explicitly states 'remote authenticated attacker,' warranting PR:L over the official PR:N; impact is confined to low confidentiality with no integrity or availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Aug 20, 2026 - 21:52 NVD

5.3 (MEDIUM) 6.5 (MEDIUM)

Analysis Generated

Aug 14, 2026 - 20:36 vuln.today

DescriptionNVD

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication.

AnalysisAI

Sensitive information disclosure in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 stems from improper authentication (CWE-287), enabling remote attackers to retrieve data beyond their authorized scope. The official CVSS vector rates this as PR:N (no privileges required), yet IBM's own description qualifies the attacker as 'remote authenticated' - a direct conflict that security teams should resolve with the vendor before assuming exploitability by unauthenticated parties. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The vulnerability affects IBM Db2 Mirror for i specifically - not Db2 for LUW or other IBM i database products - and requires that a Db2 Mirror configuration is active and reachable over the network. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS base score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N signals a low-complexity, network-reachable information disclosure with no privileges required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	IBM has released a patch addressing this vulnerability; administrators should consult the official advisory at https://www.ibm.com/support/pages/node/7283359 for the exact fix version and PTF (Program Temporary Fix) details specific to IBM i. … Detailed patch versions, workarounds, and compensating controls in full report.