IBM Db2 Mirror CVE-2026-18554

The CVE description explicitly restricts the threat actor to a 'remote authenticated attacker,' implying valid credentials to IBM Db2 Mirror for i are a prerequisite - however, this directly contradicts the NVD CVSS vector (PR:N), and the correct authentication requirement is not independently confirmed from the available advisory text. Exploitation requires network-level access to the IBM Db2 Mirror for i service (AV:N) with no user interaction needed (UI:N). What limits exploitation: valid credentials may be required (per description, unconfirmed by CVSS - must be clarified with vendor); the target must be running IBM Db2 Mirror for i at version 7.4, 7.5, or 7.6 specifically; and the IBM i platform itself occupies a narrow, predominantly large-enterprise deployment footprint. The CVE description and available tags do not identify a specific non-default configuration setting as a prerequisite beyond running the affected software on an affected version.

The CVSS 3.1 base score of 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N signals a network-exploitable, low-complexity flaw with high confidentiality impact - however, a material discrepancy exists: the NVD-assigned vector sets PR:N (no authentication required) while the CVE description explicitly limits the threat actor to a 'remote authenticated attacker.' This conflict is operationally significant because it determines whether the vulnerability is exploitable pre-authentication and therefore whether it can be mass-targeted; security teams must verify the correct requirement against the full IBM advisory text at node/7283359 before using the raw CVSS score to prioritize remediation. EPSS data was not provided in the available intelligence set, preventing probabilistic exploitation rate assessment. No CISA KEV listing and no publicly available exploit code have been identified, which meaningfully reduces near-term exploitation probability relative to the CVSS score alone. The IBM i platform's specialized enterprise deployment base further constrains blast radius - even a mid-sized municipal IT team in mielec running IBM i infrastructure should treat this as urgent pending auth-requirement clarification, but widespread automated opportunistic scanning campaigns are unlikely given the platform's narrow footprint compared to commodity Linux or Windows environments.

A remote attacker with network access to the IBM Db2 Mirror for i service submits a crafted request containing path traversal sequences (e.g., '../../../' patterns) that the application fails to sanitize before constructing a file path, causing the server to resolve and return a file outside the intended restricted directory. This could yield sensitive data such as database configuration files, replication credentials, or system state objects. No public exploit code has been identified at time of analysis, but the AC:L designation in the CVSS vector indicates that exploitation is considered low-complexity once the traversable endpoint is identified.