EUVD-2026-57380
GHSA-2r7j-rxjx-fcp9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Db2 Mirror for i endpoint
-
DeliverySend request with shell metacharacters
-
ExploitInjected input reaches OS command
-
ExecutionArbitrary commands execute on IBM i host
-
ImpactFull compromise of confidentiality, integrity, availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The prerequisite is network reachability to the Db2 Mirror for i service on an IBM i 7.4, 7.5, or 7.6 host that has the Db2 Mirror function deployed; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required against a reachable instance. The primary limiting factor is exposure of the Db2 Mirror interface - deployments that keep the mirroring/management interface on an isolated replication network unreachable from untrusted clients sharply reduce real-world exploitability, and only the specific IBM i releases running Db2 Mirror for i are affected, not general IBM i or base Db2 installations. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a near-worst-case remotely reachable, unauthenticated, low-complexity command-injection bug with full CIA impact, which by itself argues for urgent remediation. Tempering that: this is a niche IBM i platform component with a comparatively small deployment footprint, there is no CISA KEV listing and no evidence of a public proof-of-concept, and no EPSS score was supplied, so exploitation-probability signals are currently absent rather than reassuring. The realistic reading is that this is a genuinely dangerous flaw whose exposure depends heavily on whether the Db2 Mirror interface is network-reachable from untrusted zones; where it is, even a small operations team should treat this as urgent and patch promptly, while air-gapped or tightly segmented mirroring links reduce practical risk. Note the missing EPSS/KEV data means priority here rests on the CVSS profile and vendor patch availability, not on observed attacker activity - that gap should be stated openly rather than assumed as low risk. |
| Exploit ScenarioDerived | An attacker with network reach to an internet- or intranet-exposed Db2 Mirror for i endpoint sends a crafted request containing shell metacharacters in a field that the product passes into an OS command, causing the injected commands to run on the IBM i host with the privileges of the Db2 Mirror process. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication, victim interaction, or complex preconditions are required, though no public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 12, 2026
OS command injection in IBM Db2 Mirror for i (releases 7.4, 7.5, and 7.6) lets a remote, unauthenticated attacker execute arbitrary operating-system commands on the affected IBM i host by injecting unneutralized special characters into a command the product builds and runs. The flaw is rated CVSS 9.8 with full confidentiality, integrity, and availability impact and a network attack vector requiring no privileges or user interaction. No public exploit has been identified at time of analysis, but a vendor patch is available and the low attack complexity makes this a high-priority fix.
RemediationAI
Apply the IBM-provided fix as documented in the vendor advisory at https://www.ibm.com/support/pages/node/7283281 (Patch available per vendor advisory); the advisory identifies the specific PTFs/Group PTF levels for IBM i 7.4, 7.5, and 7.6, so apply the fix pack corresponding to your release rather than an assumed version number. Until the PTF is applied, reduce exposure by restricting network access to the Db2 Mirror service so that only trusted, authenticated administrative hosts on a segmented management network can reach it, and place the mirroring communication path on an isolated replication VLAN - with the trade-off that overly aggressive firewalling can disrupt legitimate active-active synchronization between mirror partitions, so validate rules against the documented Db2 Mirror ports before enforcing. Monitor IBM i audit journals for anomalous command execution originating from the Db2 Mirror function as a detective control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM Db2 Mirror for i is a high-availability/continuous-availability replication technology for the IBM i (AS/400 lineage) platform, providing synchronous active-active database mirroring between IBM i partitions. The vulnerability is a CWE-78 (Improper Neutralization of Special Elements used in an OS Command, 'OS Command Injection') defect: the product incorporates externally influenced input into a string that is passed to an operating-system shell or command interpreter without adequately sanitizing shell metacharacters (such as ;, |, &, $(), or backticks). The single affected CPE is cpe:2.3:a:ibm:db2_mirror_for_i, confirming the issue is in the Db2 Mirror application layer on IBM i rather than the base Db2 database engine or the OS itself.
Know when Db2 Mirror For I gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states a remote attacker can inject OS commands with no stated authentication or interaction, giving AV:N/AC:L/PR:N/UI:N and full C/I/A impact on the host.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
Executive ViewAI
IBM Db2 Mirror for i versions 7.4-7.6 contain a critical vulnerability allowing unauthenticated remote command execution; no public exploit has been identified at time of analysis, but the trivial attack complexity makes this a high-priority security risk. Organizations operating these database versions face immediate vulnerability to data compromise or service disruption and require urgent vendor patching. The lack of authentication barriers means any internet-accessible database server can be targeted by attackers.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
More in Db2 Mirror For I
View allAuthenticated attackers with low privileges can escalate to elevated privileges on IBM i systems running Db2 Mirror for
Remote code execution in IBM Db2 Mirror for i (versions 7.4, 7.5, and 7.6) allows a remote unauthenticated attacker to r
Authentication bypass in IBM Db2 Mirror for i (versions 7.4, 7.5, and 7.6) lets a remote, unauthenticated attacker read
Remote CL command execution in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 lets a remote attacker run arbitrary Control Langu
Security restriction bypass in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 permits remote authenticated attackers to exceed t
Arbitrary file write via path traversal in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 enables remote unauthenticated attacke
Arbitrary file deletion in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 is achievable by remote authenticated attacke
Sensitive file disclosure in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 is possible through a path traversal flaw (
Path traversal in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote authenticated attackers to read sensiti
Arbitrary file write via path traversal in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes systems to unauthenti
Uncontrolled recursion in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote unauthenticated attackers to cr
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes a network-accessible pathway through which an unauthenticated re
Exploit-DB