What is the CVSS score of CVE-2026-17175?

CVE-2026-17175 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.6%.

Which versions of IBM Db2 Mirror for i are affected by CVE-2026-17175?

Vulnerability CVE-2026-17175 in IBM Db2 Mirror for i versions 7.4-7.6 allows unauthenticated remote attackers to access sensitive data.. A patch is available.

How to fix or mitigate CVE-2026-17175?

Within 24 hours, identify and inventory all production systems running Db2 Mirror for i versions 7.4, 7.5, or 7.6, including their network accessibility. Within 7 days, obtain the vendor patch from IBM and validate it in a non-production environment. Within 30 days, deploy the patch to all affected systems and verify that authentication controls are properly restored.

IBM Db2 Mirror for i CVE-2026-17175

EUVD-2026-58759 MEDIUM

Improper Authentication (CWE-287)

2026-08-14 ibm

GHSA-5fjq-x8h9-83cx

Authentication Bypass IBM Db2 Mirror For I

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Description specifies authenticated attacker, warranting PR:L over the supplied PR:N; no integrity or availability impact indicated.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Aug 20, 2026 - 21:37 NVD

HIGH MEDIUM

CVSS changed

Aug 20, 2026 - 21:37 NVD

7.5 (HIGH) 6.5 (MEDIUM)

Analysis Generated

Aug 14, 2026 - 20:26 vuln.today

CVE Published

Aug 14, 2026 - 19:20 nvd

HIGH 7.5

DescriptionNVD

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement.

AnalysisAI

Improper authentication enforcement in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes sensitive information to remote attackers via CWE-287, allowing bypassed or unenforced authentication checks to leak protected data. A critical discrepancy exists between the CVE description - which names a 'remote authenticated attacker' - and the CVSS vector (PR:N), which implies no authentication is needed; this ambiguity affects real-world risk assessment and should be resolved against the IBM advisory. No public exploit code has been identified at time of analysis, and a vendor patch is available.

Technical ContextAI

IBM Db2 Mirror for i is a high-availability, near-continuous data replication solution for the IBM i (formerly AS/400) platform, enabling database mirroring between IBM i systems. The affected CPE (cpe:2.3:a:ibm:db2_mirror_for_i) covers all sub-versions of 7.4, 7.5, and 7.6 without further version constraint, meaning the full release lines are implicated. The root cause is classified as CWE-287 (Improper Authentication), a category describing failures to correctly verify a claimed identity - typically manifesting as authentication checks that are skipped on certain code paths, improperly validated tokens, or session state that can be assumed without proper credential verification. In a mirroring product, such a flaw is particularly sensitive because replication channels often carry full database contents including schema, credentials, and business data.

RemediationAI

Apply the vendor-released patch documented in IBM Security Bulletin at https://www.ibm.com/support/pages/node/7283359 for affected versions 7.4, 7.5, and 7.6. An exact fixed version number was not independently extractable from the available advisory reference data and should be confirmed directly from the IBM support page. As a compensating control while patching, restrict network-level access to IBM Db2 Mirror for i replication and management interfaces using firewall rules or IBM i network access controls (e.g., TCP/IP filter rules), limiting connectivity to only authorized replication partner systems and administrative hosts. Note that network isolation does not remediate the authentication logic flaw itself and carries the operational trade-off of potentially disrupting legitimate replication traffic if filter rules are misconfigured.