IBM Db2 Mirror CVE-2026-17209

The CVSS vector PR:L confirms that exploitation requires a valid low-privileged authenticated account on the IBM Db2 Mirror for i web interface - unauthenticated exploitation is not possible. UI:R indicates that a second victim user must actively interact with (i.e., browse to) the page containing the injected payload; exploitation cannot be completed by the attacker alone. The vulnerability is scoped to the web administrative interface of IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 specifically. Exploitation is limited by the need for both an attacker-controlled low-privilege account and a victim (ideally higher-privileged) user who views attacker-influenced content within the same application. Environments where all Db2 Mirror web accounts are tightly controlled or restricted to a small set of trusted administrators face substantially lower realistic risk.

The CVSS 6.3 (Medium) score reflects meaningful but bounded real-world risk. The attack vector (AV:N) confirms the vulnerability is remotely reachable over the network, but two key mitigating signals - PR:L (requires a valid low-privileged account) and UI:R (victim must interact with malicious content) - substantially reduce automated or mass exploitation potential. The scope is unchanged (S:U), confining impact to the Db2 Mirror web application context. No EPSS score was provided in the available data, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, and no proof-of-concept has been identified, further lowering the near-term threat posture. Despite the I:H rating, the realistic attack path requires an authenticated foothold and social engineering or persistent stored payload to reach a privileged victim. This is a real but targeted risk, not a mass-exploitation-class vulnerability. Defenders should prioritize patching in environments where untrusted or external users hold low-privileged accounts to the Db2 Mirror interface.

An attacker with a low-privileged account on the IBM Db2 Mirror for i web interface submits a crafted XSS payload through a user-controllable input field - such as a configuration name, label, or comment field - that is subsequently stored and rendered in administrative views. When a Db2 Mirror administrator later browses the affected page, the injected script executes in their browser, potentially capturing their session token and allowing the attacker to perform privileged operations under the administrator's identity. No public proof-of-concept has been identified at time of analysis.