What is the CVSS score of CVE-2026-16956?

CVE-2026-16956 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.0%.

Which versions of IBM Db2 Mirror are affected by CVE-2026-16956?

IBM Db2 Mirror for i versions 7.4-7.6 contain a critical vulnerability allowing unauthenticated remote command execution; no public exploit has been identified at time of analysis, but the trivial…. A patch is available.

How to fix or mitigate CVE-2026-16956?

Within 24 hours, conduct an inventory of all systems running IBM Db2 Mirror for i versions 7.4, 7.5, or 7.6 and categorize by criticality and network exposure. Within 7 days, download the latest vendor-released patch from IBM and test it thoroughly in a non-production environment that mirrors production configurations. Within 30 days, deploy the patch to all affected Db2 Mirror for i systems, prioritizing internet-facing and business-critical instances, and verify successful remediation using vendor-supplied validation tools.

IBM Db2 Mirror CVE-2026-16956

EUVD-2026-57380 CRITICAL

OS Command Injection (CWE-78)

2026-08-12 ibm

GHSA-2r7j-rxjx-fcp9

Command Injection IBM Db2 Mirror For I

9.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Description states a remote attacker can inject OS commands with no stated authentication or interaction, giving AV:N/AC:L/PR:N/UI:N and full C/I/A impact on the host.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 18:40 vuln.today

CVE Published

Aug 12, 2026 - 17:30 nvd

CRITICAL 9.8

DescriptionCVE.org

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

AnalysisAI

OS command injection in IBM Db2 Mirror for i (releases 7.4, 7.5, and 7.6) lets a remote, unauthenticated attacker execute arbitrary operating-system commands on the affected IBM i host by injecting unneutralized special characters into a command the product builds and runs. The flaw is rated CVSS 9.8 with full confidentiality, integrity, and availability impact and a network attack vector requiring no privileges or user interaction. No public exploit has been identified at time of analysis, but a vendor patch is available and the low attack complexity makes this a high-priority fix.

Technical ContextAI

IBM Db2 Mirror for i is a high-availability/continuous-availability replication technology for the IBM i (AS/400 lineage) platform, providing synchronous active-active database mirroring between IBM i partitions. The vulnerability is a CWE-78 (Improper Neutralization of Special Elements used in an OS Command, 'OS Command Injection') defect: the product incorporates externally influenced input into a string that is passed to an operating-system shell or command interpreter without adequately sanitizing shell metacharacters (such as ;, |, &, $(), or backticks). The single affected CPE is cpe:2.3:a:ibm:db2_mirror_for_i, confirming the issue is in the Db2 Mirror application layer on IBM i rather than the base Db2 database engine or the OS itself.

RemediationAI

Apply the IBM-provided fix as documented in the vendor advisory at https://www.ibm.com/support/pages/node/7283281 (Patch available per vendor advisory); the advisory identifies the specific PTFs/Group PTF levels for IBM i 7.4, 7.5, and 7.6, so apply the fix pack corresponding to your release rather than an assumed version number. Until the PTF is applied, reduce exposure by restricting network access to the Db2 Mirror service so that only trusted, authenticated administrative hosts on a segmented management network can reach it, and place the mirroring communication path on an isolated replication VLAN - with the trade-off that overly aggressive firewalling can disrupt legitimate active-active synchronization between mirror partitions, so validate rules against the documented Db2 Mirror ports before enforcing. Monitor IBM i audit journals for anomalous command execution originating from the Db2 Mirror function as a detective control.