What is the CVSS score of CVE-2026-17184?

CVE-2026-17184 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Db2 Mirror for i are affected by CVE-2026-17184?

IBM Db2 Mirror for i (versions 7.4, 7.5, 7.6) contains a critical vulnerability allowing remote attackers to gain complete control of affected systems without authentication.. A patch is available.

How to fix or mitigate CVE-2026-17184?

Within 24 hours: Identify all systems running IBM Db2 Mirror for i versions 7.4, 7.5, or 7.6 and restrict network access to administrative users only. Within 7 days: Obtain the vendor-released patch from IBM, test in a non-production environment, and begin staged deployment starting with non-critical systems. Within 30 days: Complete patching of all affected production systems and validate patch application across your environment.

Db2 Mirror for i CVE-2026-17184

EUVD-2026-58765 CRITICAL

External Control of File Name or Path (CWE-73)

2026-08-14 ibm

GHSA-8vgw-387f-c2xm

RCE IBM Db2 Mirror For I

9.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable replication service with unauthenticated, low-complexity path-control leading to code execution justifies AV:N/AC:L/PR:N and full C:H/I:H/A:H on the host.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 20:23 vuln.today

CVE Published

Aug 14, 2026 - 19:22 nvd

CRITICAL 9.8

DescriptionCVE.org

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code due to external control of file name or path.

AnalysisAI

Remote code execution in IBM Db2 Mirror for i (versions 7.4, 7.5, and 7.6) allows a remote unauthenticated attacker to run arbitrary code by exploiting external control of a file name or path (CWE-73). The flaw carries a CVSS 9.8 rating with a network attack vector and no privileges or user interaction required, and IBM has published a fix. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

Db2 Mirror for i is IBM's continuous-availability and synchronous database replication feature for the IBM i (formerly AS/400 / iSeries) platform, keeping two IBM i nodes in an active-active mirrored state. The root cause is CWE-73 (External Control of File Name or Path): an interface within the product accepts a file name or path value that is influenced by attacker-supplied input and uses it in a filesystem or code-loading operation without adequate validation. When such controlled paths feed a load/execute or write primitive, an attacker can direct the process to a location under their control, yielding arbitrary code execution. The affected component is identified by CPE cpe:2.3:a:ibm:db2_mirror_for_i, confirming an application-level (not OS-level) flaw scoped to the Db2 Mirror service across releases 7.4 through 7.6.

RemediationAI

Apply the IBM-provided fix as the primary remediation: patch available per vendor advisory at https://www.ibm.com/support/pages/node/7283359 (apply the applicable PTF/fix for your 7.4, 7.5, or 7.6 release; an exact fixed version string was not included in the provided data, so obtain the precise PTF level from that advisory). Until the fix is applied, reduce exposure by network-restricting access to the Db2 Mirror service so only the paired mirror node and trusted administrative hosts can reach its ports - this limits the AV:N vector at the cost of requiring correct firewall/segmentation rules and verified peer addresses - and monitor the IBM i host for anomalous file writes or unexpected process spawning by the Db2 Mirror service. Do not disable Db2 Mirror itself unless you can tolerate loss of the synchronous high-availability protection it provides.