Db2 Mirror for i CVE-2026-17182

Exploitation requires network reachability to the Db2 Mirror for i HTTP service on an affected node (7.4, 7.5, or 7.6) and the ability to send a request with crafted URI path segments; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication and no user interaction are needed against a default-affected installation. The principal limiting factor is exposure of the Db2 Mirror administrative/service interface: if that endpoint is confined to an isolated management network or firewalled off from untrusted hosts, remote exploitation is correspondingly constrained. The system must also be running an unpatched 7.4/7.5/7.6 level.

The signals here are consistent and point to genuinely high risk rather than an inflated score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical) describes network-reachable, low-complexity, unauthenticated exploitation with full confidentiality, integrity, and availability impact, and this aligns cleanly with the described unauthenticated auth-bypass behavior - the vector and description do not conflict. No EPSS score, SSVC decision, or CISA KEV entry was provided, so probabilistic exploitation likelihood and confirmed in-the-wild activity are unknown; the absence of a KEV listing and of any referenced proof-of-concept means there is no evidence of active exploitation at this time. Even so, because IBM i systems frequently hold core financial and business-of-record data and Db2 Mirror sits on the availability-critical path, any operator running an affected version - from a large enterprise to a mid-sized municipal IT team - should treat patching as urgent regardless of the missing EPSS/KEV data. The main uncertainty is exposure: real-world risk depends heavily on whether the Db2 Mirror administrative interface is network-reachable from untrusted segments, which is deployment-specific and not captured by the CVSS score alone.

An attacker who can reach the Db2 Mirror for i service over the network sends an HTTP request with specially crafted URI path segments that the server mis-parses, causing it to bypass authentication and route the request to a protected handler. With no credentials or user interaction, the attacker then reads sensitive replication/configuration or database data and can alter it, undermining the integrity of the mirrored environment. No public proof-of-concept has been identified, so exploitation currently requires the attacker to independently reconstruct the path-parsing bypass.