Db2 Mirror for i CVE-2026-17173

Requires a valid low-privilege authenticated session on an IBM Db2 Mirror for i instance running version 7.4, 7.5, or 7.6, accessible over the network (AV:N, PR:L). No special non-default configuration or additional feature activation is described as a prerequisite beyond holding an authenticated user account on the system. Exploitation is scoped exclusively to confidentiality - read-only file access outside the intended directory (C:H, I:N, A:N) - and confined to the vulnerable system (S:U), preventing automatic lateral scope expansion. Limiting factors: authentication is mandatory (PR:L eliminates unauthenticated exploitation), and the IBM i platform's inherent object-level authority model may provide additional access controls on specific files that partially constrain what a traversal can reach.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates network reachability with low attack complexity, but the PR:L metric confirms a valid low-privileged account is required, meaningfully restricting opportunistic exposure to credentialed users of the system. The high confidentiality impact (C:H) suggests path traversal could expose replication configuration, IBM i authority data, credentials, or other sensitive objects that are material in enterprise IBM i environments - which frequently host financial, ERP, and transactional data. Impact is strictly limited to information disclosure; no integrity modification or availability degradation is possible via this path. EPSS data was not supplied in the available intelligence, and the vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog, providing no confirmed signal of active exploitation. No public proof-of-concept code has been identified. Real-world priority is moderate: the authentication barrier is a genuine limiting factor, but the IBM i platform's typical role as a high-value business data store means even authenticated read access to arbitrary files can carry material business risk in sensitive deployments.

An attacker with a low-privileged account on an affected IBM Db2 Mirror for i system submits a crafted request containing path traversal sequences (e.g., '../../') to a vulnerable file-handling interface, bypassing the application's path restriction logic and reading files outside the intended directory. Targeted files could include replication configuration, IBM i object authority tables, or system credentials stored on the paired nodes. No public proof-of-concept has been identified, but the low attack complexity (AC:L) rating suggests the traversal technique is straightforward once an authenticated session is established.