IBM Db2 Mirror CVE-2026-18178

Exploitation requires a valid low-privileged authenticated session on the IBM Db2 Mirror for i system, as confirmed by the CVSS PR:L metric - unauthenticated exploitation is not possible. The attack is conducted remotely over the network (AV:N) with no requirement for user interaction (UI:N). No special non-default configuration of Db2 Mirror for i is required; the flaw is present in default installations of all affected versions (7.4, 7.5, 7.6). The primary limiting factor is the credential requirement: an attacker must first possess or acquire a valid IBM i user account with access to the Db2 Mirror for i component, which constrains opportunistic mass exploitation and limits risk to scenarios involving insider threat, phishing, credential compromise, or lateral movement from an already-compromised IBM i session.

The CVSS 8.1 High score is primarily driven by the high integrity (I:H) and availability (A:H) impacts - the ability to delete arbitrary files can destroy database files, configuration, or operating system components critical to IBM i operation. The network attack vector (AV:N) with low complexity (AC:L) and low privilege requirement (PR:L) makes exploitation straightforward once credentials are obtained. However, the EPSS score of 0.44% at the 37th percentile indicates that exploitation probability in the real world is modest, and the absence of KEV listing and public POC code further reduces immediate urgency compared to the raw CVSS would suggest. The authentication prerequisite (PR:L) is a meaningful limiting factor: an attacker must first obtain valid IBM i credentials, which constrains opportunistic mass exploitation. The IBM i platform has a niche enterprise footprint concentrated in industries like manufacturing, finance, and government, meaning overall exposure is lower than equivalent flaws in ubiquitous web platforms. Organizations running IBM Db2 Mirror for i in production, including any mid-sized operator with IBM i-dependent workloads, should treat patching as a priority within their normal patch cycle rather than as an emergency out-of-band response, balancing the high theoretical impact against the low observed exploitation signal.

An attacker who has obtained low-privileged IBM i credentials - through phishing, credential reuse, or insider access - submits a crafted network request to a Db2 Mirror for i file operation endpoint containing path traversal sequences such as '../../' in a filename parameter. The application processes the unsanitized path and executes a file deletion against an arbitrary target outside the intended directory, potentially removing database data files, PTF components, or critical IBM i system objects. No public exploit code has been identified, but the low attack complexity means exploitation is technically straightforward given valid credentials.