Db2 Mirror for i CVE-2026-17184

The attacker needs network access to the Db2 Mirror for i service on a host running an affected release (7.4, 7.5, or 7.6) with the Db2 Mirror feature enabled and reachable - Db2 Mirror is an opt-in high-availability replication configuration, so systems that do not deploy it are not exposed. Per the CVSS vector (PR:N/UI:N), no authentication and no user interaction are required, and no non-default toggle beyond having the mirror service active and network-reachable is indicated in the description. The principal limiting factors are therefore deployment scope (only IBM i environments actually using Db2 Mirror) and network reachability of the service, which segmented HA replication links often restrict to the peer node.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes the worst-case profile: network-reachable, low-complexity, no authentication, no user interaction, with full confidentiality, integrity, and availability impact - the definition of a top-priority patch. Because RCE on a database-replication service typically means compromise of the underlying IBM i host and the mirrored data set, even a mid-sized municipal IT team in swidnica running Db2 Mirror should treat this as urgent and patch on an emergency cycle. That said, no EPSS score, no KEV listing, and no confirmed proof-of-concept were provided, so exploitation is currently theoretical rather than observed - the raw severity is maximal, but the demonstrated real-world exploitation signal is absent, suggesting priority driven by potential impact rather than confirmed in-the-wild activity. The main mitigating reality is prevalence: Db2 Mirror is a specialized IBM i HA feature, so the exposed population is far smaller and typically better-segmented than for internet-facing web software.

A remote attacker with network reachability to the Db2 Mirror service sends crafted input that controls a file name or path parameter, steering the service to load or write to an attacker-influenced location and execute attacker-supplied code on the IBM i host - all without credentials or user interaction (AV:N/AC:L/PR:N/UI:N). No public proof-of-concept has been identified, so a working exploit would need to be developed, but the low attack complexity implies this is achievable once the vulnerable code path is understood.