What is the CVSS score of EUVD-2026-58764?

EUVD-2026-58764 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Db2 Mirror for i are affected by EUVD-2026-58764?

IBM Db2 Mirror for i (versions 7.4, 7.5, 7.6) contains a critical vulnerability that allows remote attackers without credentials to read and modify sensitive database information by bypassing…. A patch is available.

How to fix or mitigate EUVD-2026-58764?

Within 24 hours, identify all IBM Db2 Mirror for i systems running versions 7.4, 7.5, or 7.6 and assess whether the replication/administration interface is accessible from the network; immediately implement network restrictions if exposure exists. Within 7 days, apply the vendor-released patch per IBM's security advisory to all affected systems, prioritizing production environments. Within 30 days, verify successful patch application across the entire fleet, validate that the authentication mechanism is functioning correctly, and review system access logs for any evidence of exploitation.

Db2 Mirror for i EUVD-2026-58764

| CVE-2026-17182 CRITICAL

Improper Authentication (CWE-287)

2026-08-14 ibm

GHSA-h62j-pwmp-3j2q

Authentication Bypass IBM Db2 Mirror For I

9.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable, low-complexity, unauthenticated auth bypass with no user interaction yielding full read/alter of sensitive data, so PR:N, UI:N, and C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 20:24 vuln.today

CVE Published

Aug 14, 2026 - 19:22 nvd

CRITICAL 9.8

DescriptionCVE.org

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and obtain or alter sensitive information due to improper validation of request URI path segments.

AnalysisAI

Authentication bypass in IBM Db2 Mirror for i (versions 7.4, 7.5, and 7.6) lets a remote, unauthenticated attacker read or modify sensitive information by exploiting improper validation of request URI path segments. Because the flaw is reachable over the network without credentials or user interaction, an attacker can defeat access controls on the replication/administration interface and reach protected functionality or data. No public exploit has been identified at time of analysis, but the maximal CVSS 9.8 rating and the low attack complexity make this a high-priority patching target.

Technical ContextAI

Db2 Mirror for i is IBM's continuous-availability replication technology for the IBM i (formerly AS/400 / iSeries) platform, providing synchronous database mirroring between two IBM i nodes and exposing HTTP-based administrative/service endpoints. The root cause is CWE-287 (Improper Authentication): the service validates request URI path segments incorrectly, so certain crafted paths are treated as authenticated or as bypassing the intended authorization checkpoint. This is a classic path-parsing/authentication-decoupling weakness where the component that routes the request and the component that enforces authentication disagree on the canonical path, allowing a request to slip past the auth gate and reach a protected handler.

RemediationAI

Apply the vendor fix: IBM has released a patch, documented at https://www.ibm.com/support/pages/node/7283359 - install the fixing PTF/level indicated there for your specific release (7.4, 7.5, or 7.6). The exact patched build/PTF numbers are not enumerated in the provided data and should be taken directly from that advisory rather than assumed. As compensating controls until patching is complete, restrict network access to the Db2 Mirror administrative/service endpoints so they are reachable only from trusted management networks or via VPN/jump host (side effect: remote administration must go through that path), and place the interface behind a reverse proxy or firewall rule that blocks or normalizes anomalous URI path segments (side effect: mis-tuned normalization rules could break legitimate admin requests). Monitor access logs for unexpected requests to protected paths as a detection stopgap.