What is the CVSS score of EUVD-2026-58761?

EUVD-2026-58761 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 1.0%.

Which versions of IBM Db2 Mirror are affected by EUVD-2026-58761?

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 contain a command injection vulnerability allowing low-privilege authenticated users to trigger service-wide denial of service without user…. A patch is available.

How to fix or mitigate EUVD-2026-58761?

Within 24 hours, enumerate all systems running Db2 Mirror for i versions 7.4, 7.5, or 7.6 and verify network access is restricted to administrative users only. Within 7 days, apply the vendor-released patch to all affected systems in a staged rollout beginning with production databases supporting business-critical applications. Within 30 days, complete remediation of all remaining instances and validate deployment through change control procedures to confirm no vulnerable versions remain in production or standby environments.

IBM Db2 Mirror EUVD-2026-58761

| CVE-2026-17179 MEDIUM

OS Command Injection (CWE-78)

2026-08-14 ibm

GHSA-5g6p-hrhp-3hfw

Denial Of Service Command Injection IBM Db2 Mirror For I

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

8.5 HIGH

Network-reachable injection with low-privilege auth; scope change to OS justified by CWE-78; availability dominant, no confidentiality impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Severity Changed

Aug 20, 2026 - 21:22 NVD

HIGH MEDIUM

CVSS changed

Aug 20, 2026 - 21:22 NVD

8.5 (HIGH) 6.5 (MEDIUM)

Analysis Generated

Aug 14, 2026 - 20:25 vuln.today

CVE Published

Aug 14, 2026 - 19:20 nvd

HIGH 8.5

DescriptionNVD

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service due to command injection.

AnalysisAI

Command injection in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote authenticated attackers to trigger a denial of service condition that extends beyond the vulnerable component due to a scope change (S:C per CVSS vector). The flaw, rooted in CWE-78 improper neutralization of OS command elements, requires only low-privilege credentials and no user interaction to exploit over the network. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though a vendor patch is available.

Technical ContextAI

IBM Db2 Mirror for i is a high-availability, real-time database mirroring solution designed specifically for the IBM i platform (historically AS/400). It continuously replicates Db2 data between IBM i nodes to support disaster recovery and near-zero-downtime operations. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning user-supplied input is incorporated into OS-level command strings without adequate sanitization, allowing injection of arbitrary OS commands through crafted input. The CPE string cpe:2.3:a:ibm:db2_mirror_for_i:*:*:*:*:*:*:*:* confirms all sub-versions of the 7.4, 7.5, and 7.6 release lines are within scope. The CVSS scope change metric (S:C) indicates that successful exploitation extends impact to components outside the Db2 Mirror process itself - consistent with OS command injection reaching the underlying IBM i operating environment.

RemediationAI

IBM has released a patch addressing this vulnerability; organizations should consult the official advisory at https://www.ibm.com/support/pages/node/7283359 for the specific fix version and installation guidance, as an exact patched version number was not independently confirmed from available data. Where immediate patching is not feasible, restrict network access to the Db2 Mirror administrative interfaces to only trusted internal hosts using firewall rules or IBM i network attribute controls, which reduces the remote attack surface at the cost of operational flexibility for remote administration. Additionally, review and enforce least-privilege principles for all accounts with access to Db2 Mirror management functions, ensuring no unnecessary low-privilege accounts can reach injection-susceptible interfaces.