IBM Db2 Mirror for i CVE-2026-17181

The CVSS vector (PR:N/UI:N/AV:N/AC:L) indicates no authentication, no user interaction, and low complexity are required. Exploitation requires only network reachability to a Db2 Mirror for i service port on an IBM i system running version 7.4, 7.5, or 7.6. No special non-default configuration or specific feature enablement is indicated in available data. The primary limiting factors are: (1) IBM i systems are typically not internet-facing - they are most commonly deployed in private data center or enterprise WAN environments, reducing attacker surface; (2) Db2 Mirror for i must be actively installed and licensed, as it is an add-on product, not a default IBM i component; (3) network segmentation common in IBM i deployments may restrict access to replication service ports.

The CVSS base score of 8.6 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N reflects a genuinely severe integrity threat: network-accessible, zero-click, unauthenticated arbitrary file write crossing scope boundaries. However, EPSS at 0.59% (46th percentile) is notably low for a score this high, and the CVE is not present in CISA KEV, indicating no confirmed mass exploitation at time of analysis. The divergence between CVSS severity and EPSS exploitation probability is consistent with a niche enterprise platform (IBM i) with a limited global install base and high-friction operational environments that may reduce attacker opportunity. The absence of a confirmed POC further moderates near-term exploitation risk. That said, arbitrary file write with scope change on a database replication system is a genuine critical priority for IBM i operators - successful exploitation could allow placement of malicious binaries, configuration tampering, or persistence mechanisms at OS level. Patch availability is confirmed; delay is the primary remaining risk.

An unauthenticated remote attacker sends a crafted request to a network-exposed Db2 Mirror for i service endpoint, embedding path traversal sequences (e.g., '../../../QSYS.LIB/') in a file-path parameter. The application processes the traversal without sanitization and writes attacker-controlled content to an OS-level path on the IBM i system. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) means exploitation is straightforward once the specific endpoint and parameter are identified.