IBM Db2 Mirror CVE-2026-17177

No special configuration is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U): the vulnerability is exploitable remotely by unauthenticated attackers against default deployments of IBM Db2 Mirror for i 7.4, 7.5, or 7.6. The primary limiting factor is platform specificity - only systems running IBM i (AS/400 / iSeries) with Db2 Mirror for i installed are affected; mainstream Linux, Windows, or other Db2 variants are not in scope. Network reachability to the Db2 Mirror replication service is required; deployments where replication traffic is isolated to a dedicated private VLAN with no external exposure are harder to exploit but not immune to insider or lateral-movement scenarios.

The CVSS 3.1 base score of 7.5 (HIGH) is driven entirely by the favorable attacker posture: network vector, low complexity, no privileges, no user interaction. The impact, however, is limited to availability - confidentiality and integrity are unaffected (C:N/I:N/A:H). For IBM i environments, Db2 Mirror is a business-continuity component; crashing it directly undermines the high-availability architecture it provides, which can be severe even without data exposure. No EPSS score was included in the provided intelligence, so exploitation probability cannot be quantified independently. There is no CISA KEV listing and no POC reported, suggesting opportunistic exploitation has not been observed. The real-world risk is therefore moderate-to-high for organizations relying on Db2 Mirror for failover: the attack is easy to execute but the product's niche deployment footprint limits attacker motivation to targeted campaigns rather than opportunistic mass exploitation.

A remote attacker with network access to a Db2 Mirror for i replication endpoint sends a specially crafted network request designed to trigger the vulnerable recursive code path. The recursive calls accumulate on the call stack without a termination condition, exhausting available stack space or memory, which causes the Db2 Mirror service to crash. No public exploit code is known to exist, but the low attack complexity (AC:L) means exploitation would require minimal specialized tooling once the triggering input is identified.