IBM Db2 Mirror CVE-2026-17081

No special conditions are required based on the CVSS vector AV:N/AC:L/PR:N/UI:N: the vulnerability is exploitable by any remote, unauthenticated attacker who can reach the IBM Db2 Mirror for i service over the network. No specific non-default configuration or enabled feature is documented as a prerequisite in the CVE description. The primary factor limiting exploitation in practice is network reachability - Db2 Mirror for i replication services are typically deployed on private replication network segments not directly accessible from the internet, meaning exploitation would generally require the attacker to already have network-level access to the replication VLAN or internal segment. Authentication level is confirmed as none (PR:N from CVSS vector). Specific IBM i OS-level file permission controls may constrain which directories can actually be written by the service process, though this is an environmental mitigating factor not documented in the vulnerability record.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L places this firmly in high-severity territory: network-reachable, low complexity, no authentication, no user interaction required. Integrity impact is rated High, meaning an attacker can write arbitrary files, with a Low availability impact potentially reflecting partial disruption from overwritten files. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV and no POC has been identified, which moderates urgency compared to a KEV-confirmed flaw at the same CVSS. The deployment footprint of IBM Db2 Mirror for i is inherently limited to IBM i shops running Db2 replication - a niche but often critical enterprise segment in industries such as manufacturing, finance, and government. If the replication service is internet-exposed, risk is acute; if firewalled to internal replication network segments (the typical deployment), practical exploitation is constrained despite the permissive CVSS vector.

An unauthenticated remote attacker sends a crafted HTTP or protocol-level request to the IBM Db2 Mirror for i replication service containing path traversal sequences (e.g., '../../etc/cron.d/malicious') as the target file path. The server fails to sanitize the input and writes attacker-controlled content to a location outside the intended directory, potentially overwriting a configuration file, injecting a scheduled job, or planting a backdoor. No public proof-of-concept exploit is known at the time of analysis, but the low complexity and absence of authentication requirements make manual exploitation straightforward for a skilled attacker.