Skip to main content

IBM Db2 Mirror for i CVE-2026-17181

| EUVDEUVD-2026-58762 HIGH
Path Traversal (CWE-22)
2026-08-14 ibm GHSA-j3x6-f97g-2q47
Path Traversal IBM Db2 Mirror For I
8.6
CVSS 3.1 · NVD
Share

Severity by source

Vendor (ibm) PRIMARY
CRITICAL
qualitative
NVD
8.6 HIGH
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
vuln.today AI
8.6 HIGH

Network-accessible unauthenticated file write with no user interaction; scope change reflects OS-level path reach beyond the application boundary.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

6
Analysis Updated
Aug 20, 2026 - 21:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 20, 2026 - 21:22 vuln.today
cvss_changed
Severity Changed
Aug 20, 2026 - 21:22 NVD
CRITICAL HIGH
CVSS changed
Aug 20, 2026 - 21:22 NVD
9.3 (CRITICAL) 8.6 (HIGH)
Analysis Generated
Aug 14, 2026 - 20:24 vuln.today
CVE Published
Aug 14, 2026 - 19:21 nvd
CRITICAL 9.3

DescriptionNVD

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write files to arbitrary locations due to path traversal.

AnalysisAI

Arbitrary file write via path traversal in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 enables remote unauthenticated attackers to place files at any location on the underlying IBM i system. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/I:H) confirms network-reachable exploitation without authentication, with a scope change indicating impact beyond the Db2 Mirror application itself - reaching OS-level paths. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The CVSS vector (PR:N/UI:N/AV:N/AC:L) indicates no authentication, no user interaction, and low complexity are required. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS base score of 8.6 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N reflects a genuinely severe integrity threat: network-accessible, zero-click, unauthenticated arbitrary file write crossing scope boundaries. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the vendor-released patch referenced in IBM Security Advisory at https://www.ibm.com/support/pages/node/7283359 - this is the primary fix and exact patched PTF (program temporary fix) numbers should be taken directly from that advisory, as none are independently confirmed in available intelligence. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: inventory all IBM Db2 Mirror for i 7.4, 7.5, and 7.6 deployments and assess network exposure; restrict or isolate affected systems if possible. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Db2 Mirror For I

View all
CVE-2026-16956 CRITICAL
9.8 Aug 12

OS command injection in IBM Db2 Mirror for i (releases 7.4, 7.5, and 7.6) lets a remote, unauthenticated attacker execut
CVE-2026-17184 CRITICAL
9.8 Aug 14

Remote code execution in IBM Db2 Mirror for i (versions 7.4, 7.5, and 7.6) allows a remote unauthenticated attacker to r
CVE-2026-17182 CRITICAL
9.8 Aug 14

Authentication bypass in IBM Db2 Mirror for i (versions 7.4, 7.5, and 7.6) lets a remote, unauthenticated attacker read

CVE-2026-17186 CRITICAL
9.8 Aug 14

Remote CL command execution in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 lets a remote attacker run arbitrary Control Langu
CVE-2026-16879 HIGH
8.8 Aug 14

Security restriction bypass in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 permits remote authenticated attackers to exceed t
CVE-2026-18178 HIGH
8.1 Aug 14

Arbitrary file deletion in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 is achievable by remote authenticated attacke
CVE-2026-18554 HIGH
7.5 Aug 14

Sensitive file disclosure in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 is possible through a path traversal flaw (
CVE-2026-16915 HIGH
7.5 Aug 14

Path traversal in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote authenticated attackers to read sensiti
CVE-2026-17081 HIGH
7.5 Aug 14

Arbitrary file write via path traversal in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes systems to unauthenti
CVE-2026-17177 HIGH
7.5 Aug 14

Uncontrolled recursion in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote unauthenticated attackers to cr
CVE-2026-16708 HIGH
7.5 Aug 14

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes a network-accessible pathway through which an unauthenticated re
CVE-2026-17179 MEDIUM
6.5 Aug 14

Command injection in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote authenticated attackers to trigger a

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Share

CVE-2026-17181 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy