IBM Db2 Mirror CVE-2026-18567

Exploitation requires a local OS-level account on the IBM i system running IBM Db2 Mirror for i 7.4, 7.5, or 7.6 with at least *W (write) authority to the world-writable IFS directory containing the socket path. The attacker must act before or concurrently with the Db2 Mirror service binding its socket - most practically, around service startup or restart. Limiting factors: exploitation is confined to local authenticated users; IBM i is not internet-exposed by default; the impact is partial confidentiality loss (C:L) and minor availability disruption (A:L), not full system compromise. No network-facing exploitation path exists based on AV:L.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) scores 4.4 (Medium). Attack vector is strictly local, and PR:L requires an authenticated OS-level account on the IBM i system - limiting the exploitable population to users with interactive or batch job access. AC:L is somewhat generous for a race condition; however, because the socket path is predictable and the directory is world-writable, an attacker can pre-stage the socket before service startup without precise timing, making the 'race' trivially winnable and AC:L defensible. The C:L impact (partial confidentiality loss) and A:L (minor availability disruption if the service fails to bind) are consistent with socket-hijacking primitives. No KEV listing and no public exploit exist, and EPSS data was not provided. IBM i environments are specialized and not internet-facing by default, further constraining real-world risk. This is a low-urgency finding for most organizations but warrants patching on any IBM i system where local user accounts are not tightly controlled.

A local attacker with a standard OS user account on the IBM i system identifies the predictable Unix domain socket path used by Db2 Mirror for i before the service starts (e.g., at partition boot or service restart). The attacker pre-creates a socket at that path in the world-writable directory, causing Db2 Mirror to inadvertently connect to the attacker-controlled socket, exposing sensitive IPC data such as replication control messages or configuration information. No public exploit code is known to exist at time of analysis.