What is the CVSS score of CVE-2026-17177?

CVE-2026-17177 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of IBM Db2 Mirror are affected by CVE-2026-17177?

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 contain a network-accessible denial-of-service vulnerability that allows unauthenticated attackers to crash the database mirroring service without…. A patch is available.

How to fix or mitigate CVE-2026-17177?

Within 24 hours, inventory all IBM Db2 Mirror for i deployments to identify instances running versions 7.4, 7.5, or 7.6, and determine network exposure (whether accessible from untrusted networks). Within 7 days, apply the vendor-released patch to all affected Db2 Mirror for i instances, prioritizing production environments and systems handling critical business data. Within 30 days, complete patching across all environments, validate patch installation, and review network access controls to limit exposure of database services to necessary hosts only.

IBM Db2 Mirror CVE-2026-17177

EUVD-2026-58760 HIGH

Uncontrolled Recursion (CWE-674)

2026-08-14 ibm

GHSA-4rrg-j4q4-2vmw

Denial Of Service IBM Db2 Mirror For I

7.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable replication service requires no authentication to trigger recursion; impact is strictly availability loss with no confidentiality or integrity effects.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 20:25 vuln.today

CVE Published

Aug 14, 2026 - 19:20 nvd

HIGH 7.5

DescriptionCVE.org

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.

AnalysisAI

Uncontrolled recursion in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote unauthenticated attackers to crash the service, resulting in a complete loss of availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is exploitable over the network without credentials or user interaction, making it trivially reachable in any internet- or network-exposed deployment. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, but the low attack complexity elevates practical risk.

Technical ContextAI

CWE-674 (Uncontrolled Recursion) describes a code path that calls itself without an adequate termination condition, leading to stack exhaustion or resource depletion that crashes the process. IBM Db2 Mirror for i is a high-availability database replication solution exclusively for the IBM i platform (formerly AS/400 / iSeries), where it maintains a synchronized copy of an Db2 for i database between two IBM i partitions. The affected CPE (cpe:2.3:a:ibm:db2_mirror_for_i:*:*:*:*:*:*:*:*) covers the version families 7.4, 7.5, and 7.6 without specifying a sub-version floor, implying all releases within those families are vulnerable until patched. Because Db2 Mirror handles network-facing replication traffic, a remotely reachable parsing or protocol-handling routine is the likely trigger for the recursive call chain.

RemediationAI

IBM has released a patch addressing this vulnerability; apply the fix documented in the vendor advisory at https://www.ibm.com/support/pages/node/7283359, which should be consulted for the exact PTF (Program Temporary Fix) numbers applicable to each release (7.4, 7.5, 7.6). Because an exact fixed version number was not independently confirmed beyond the advisory reference, verify the specific PTF identifiers directly from the IBM support page. If immediate patching is not feasible, a compensating control is to restrict network access to Db2 Mirror replication ports at the firewall or IBM i host-based packet rules, limiting reachability to known trusted replication partners only - this does not eliminate the vulnerability but reduces the attacker's ability to trigger it. Note that tightening network ACLs in a Db2 Mirror environment must be coordinated carefully to avoid inadvertently breaking legitimate replication traffic between the primary and mirror partitions.