IBM Db2 Mirror for i EUVD-2026-58759

The CVE description states 'remote authenticated attacker,' implying that some level of valid credentials is required to trigger the authentication enforcement flaw - however, the supplied CVSS vector (PR:N) contradicts this, asserting no privileges are needed. This conflict must be resolved via the full IBM advisory at https://www.ibm.com/support/pages/node/7283359 before making definitive access-control decisions. The vulnerability requires network reachability to the affected Db2 Mirror for i service on an IBM i system running versions 7.4, 7.5, or 7.6. No user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors include the IBM i platform requirement (not a commodity OS), the niche deployment profile of Db2 Mirror specifically, and - if the description is accurate - a prerequisite for at least some form of authenticated session.

The NVD-assigned CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) classifies this as high severity with a fully unauthenticated network attack vector and high confidentiality impact. However, a material conflict exists between the CVSS vector and the CVE description: the description explicitly states 'remote authenticated attacker,' which would correspond to PR:L or PR:H, not PR:N. This discrepancy is unresolved in the available data and is consequential - if authentication is genuinely required, the real CVSS score would drop to approximately 6.5, reducing prioritization. No EPSS data is available for independent exploitation probability assessment. The vulnerability is not listed in CISA KEV, and no POC or active exploitation has been reported. Given the niche IBM i platform footprint and the absence of public exploit activity, real-world risk is moderate-to-low despite the high paper score, unless the PR:N assignment is confirmed accurate by the full vendor advisory.

An attacker with network access to an IBM i system running Db2 Mirror for i 7.4-7.6 sends crafted requests to the replication or management interface, exploiting improperly enforced authentication checks to access sensitive database replication data without completing the expected credential verification flow. If the CVSS PR:N vector is accurate, no prior credentials are needed; if the description's 'authenticated attacker' qualifier applies, the attacker must first obtain low-privilege credentials before triggering the bypass. No public exploit code is known at time of analysis.