IBM Db2 Mirror EUVD-2026-58761

Exploitation requires a valid low-privilege authenticated account (PR:L per CVSS vector) on the targeted IBM i system or one with network access to the Db2 Mirror service interface. No user interaction is required, and attack complexity is low, meaning no race conditions or special environmental states must be arranged. The scope change (S:C) implies the injected command executes in a context that can affect system components beyond the Db2 Mirror process itself. Limiting factors: the attacker must possess valid credentials at any privilege level - anonymous or unauthenticated access is insufficient. The IBM i platform itself has a restricted and typically enterprise-internal deployment, reducing internet-facing exposure. No specific non-default configuration is identified as a prerequisite in available data.

The CVSS 8.5 (High) score reflects a network-accessible, low-complexity attack requiring only low-privilege credentials, with a scope change driving the elevated score. The dominant real-world risk is high availability impact (A:H) - an authenticated attacker could disrupt the mirroring service and potentially destabilize dependent high-availability infrastructure. The integrity impact is limited (I:L) and confidentiality is unaffected (C:N), meaning this is not a data exfiltration path. The authentication prerequisite (PR:L) meaningfully limits the attacker pool compared to unauthenticated flaws, reducing opportunistic risk. No EPSS score was provided in available data, and the absence of a CISA KEV listing and any public POC suggests exploitation has not been observed at scale. The scope change is the key risk amplifier: in IBM i environments, Db2 Mirror disruption can cascade to loss of business continuity guarantees for workloads relying on replication. Overall, this is a genuine priority for IBM i shops running affected versions but not a widespread internet-facing emergency given the authentication requirement and niche platform footprint.

An attacker with low-privilege credentials on an IBM i system - such as a service account or junior operator - sends a crafted network request to the Db2 Mirror management interface containing injected OS command sequences. The system passes the unsanitized input to the IBM i command interpreter, which executes the injected commands and causes the Db2 Mirror service to crash or become unavailable, disrupting database replication and potentially triggering failover events across the HA cluster. No public POC exists at time of analysis, so exploitation requires independent discovery of the injection point.