IBM Db2 Mirror CVE-2026-18104

Exploitation requires local access to an IBM i system running Db2 Mirror for i (versions 7.4, 7.5, or 7.6) with at least low-level privileges (PR:L), plus the ability to observe data that the product encrypts using AES ECB mode. The weakness is inherent to any deployment using the affected encryption code path - no special non-default feature toggle is described - but it is limited by the local attack vector (AV:L, no remote exploitation) and by yielding only partial confidentiality loss (C:L): ECB reveals repeating plaintext block patterns rather than fully decrypting data. There is no integrity or availability impact and no user interaction is required.

This is a low-severity, low-priority informational-disclosure weakness. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 3.3) requires local access with at least low-level privileges already on the IBM i host, and yields only limited confidentiality impact (C:L) with no integrity or availability effect - consistent with the CWE-327 use of AES ECB mode, which leaks plaintext structure (identical plaintext blocks produce identical ciphertext) rather than directly exposing keys or full cleartext. No EPSS score, no CISA KEV listing, and no public exploit were provided, so exploitation is not confirmed and appears unlikely at scale. No signals conflict: the local vector, low impact, and absence of exploitation evidence all point the same direction. This is a hygiene/defense-in-depth cryptographic fix, not an urgent-patch scenario, though shops with strict data-at-rest or compliance requirements on IBM i may still prioritize it.

An attacker who already has a low-privileged local account (or an insider) on an IBM i system running Db2 Mirror for i observes ECB-mode ciphertext produced by the product and, because ECB reveals repeating plaintext blocks, infers structure or sensitive values from the encrypted data. No public exploit code is available, and the attack requires pre-existing local access, so realistic impact is limited to partial information leakage. Low complexity (AC:L) means that, given access, the observation itself is straightforward.