IBM Db2 Mirror for i CVE-2026-17186

The vulnerable condition is reachability of the Db2 Mirror for i replication/management service over the network on an IBM i host running version 7.4, 7.5, or 7.6, where an attacker-supplied value flows into a Control Language command that is not neutralized. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no privileges, and no user interaction are required, so exploitation works against a reachable default deployment. The primary limiting factor is network exposure: an organization that segments Db2 Mirror traffic to a private replication link and blocks external access substantially reduces reachability, and only the 7.4/7.5/7.6 IBM i platform running Db2 Mirror is in scope.

The signals here are strong but not maximal. The CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) describes an unauthenticated, low-complexity, remotely reachable path to full compromise, which on its face demands urgent action. Counterbalancing this, EPSS is only 0.47% (39th percentile) and there is no CISA KEV listing and no public exploit identified at time of analysis, so predicted near-term mass exploitation is currently low - this reads as a high-severity flaw that has not yet been weaponized publicly rather than an actively exploited one. An SSVC-style read would place exploitation at 'none' (no observed activity), technical impact 'total' (full command execution), and automatable likely 'yes' given no authentication or user interaction, which together still argues for prompt remediation. The practical takeaway: any organization running Db2 Mirror for i should treat this as urgent because the affected service is typically an internet- or network-reachable availability component with high privileges, and patching is cheap relative to the total-compromise impact. Data is internally consistent (network vector matches a 'remote attacker' description), so no signal conflict needs vendor clarification beyond confirming exposure of the Db2 Mirror service on your network.

An attacker with network reach to the Db2 Mirror for i service sends a crafted request whose command field embeds special elements that break out of the intended CL command context, appending attacker-chosen Control Language commands. Because no authentication or user interaction is required, the injected commands execute on the IBM i host with the service's privileges, giving the attacker command execution and full read/write/impact on the system. No public exploit is identified at time of analysis, so this would require the attacker to develop their own payload against the vulnerable command handler.