EUVD-2026-58764
GHSA-h62j-pwmp-3j2q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable, low-complexity, unauthenticated auth bypass with no user interaction yielding full read/alter of sensitive data, so PR:N, UI:N, and C/I/A:H.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and obtain or alter sensitive information due to improper validation of request URI path segments.
AnalysisAI
Authentication bypass in IBM Db2 Mirror for i (versions 7.4, 7.5, and 7.6) lets a remote, unauthenticated attacker read or modify sensitive information by exploiting improper validation of request URI path segments. Because the flaw is reachable over the network without credentials or user interaction, an attacker can defeat access controls on the replication/administration interface and reach protected functionality or data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the Db2 Mirror for i HTTP service on an affected node (7.4, 7.5, or 7.6) and the ability to send a request with crafted URI path segments; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication and no user interaction are needed against a default-affected installation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals here are consistent and point to genuinely high risk rather than an inflated score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix: IBM has released a patch, documented at https://www.ibm.com/support/pages/node/7283359 - install the fixing PTF/level indicated there for your specific release (7.4, 7.5, or 7.6). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all IBM Db2 Mirror for i systems running versions 7.4, 7.5, or 7.6 and assess whether the replication/administration interface is accessible from the network; immediately implement network restrictions if exposure exists. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Db2 Mirror For I
View allOS command injection in IBM Db2 Mirror for i (releases 7.4, 7.5, and 7.6) lets a remote, unauthenticated attacker execut
Remote code execution in IBM Db2 Mirror for i (versions 7.4, 7.5, and 7.6) allows a remote unauthenticated attacker to r
Remote CL command execution in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 lets a remote attacker run arbitrary Control Langu
Security restriction bypass in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 permits remote authenticated attackers to exceed t
Arbitrary file write via path traversal in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 enables remote unauthenticated attacke
Arbitrary file deletion in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 is achievable by remote authenticated attacke
Sensitive file disclosure in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 is possible through a path traversal flaw (
Path traversal in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote authenticated attackers to read sensiti
Arbitrary file write via path traversal in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes systems to unauthenti
Uncontrolled recursion in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote unauthenticated attackers to cr
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes a network-accessible pathway through which an unauthenticated re
Command injection in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote authenticated attackers to trigger a
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today