Db2 Mirror for i EUVD-2026-58768

Exploitation requires a valid authenticated session with at least low-level privileges on the IBM Db2 Mirror for i instance (PR:L confirmed by CVSS vector). The service must be network-accessible (AV:N), though IBM i environments are typically restricted to enterprise LAN or VPN segments. No user interaction is required (UI:N) beyond the attacker's own authenticated requests. No special non-default configuration is indicated beyond having a low-privilege user with access to the SQL interface affected by the injection point. Limiting factors include: the mandatory authentication requirement eliminating unauthenticated remote attackers; the IBM i platform's characteristically controlled network exposure; and the bounded C:L/I:L/A:N impact ceiling, which constrains the value of exploitation relative to more impactful SQL injection targets.

The CVSS 5.4 Medium score is consistent with a SQL injection bounded by authentication (PR:L) and limited impact (C:L/I:L/A:N). The 'bypass security restrictions' framing suggests the injection is used to access or manipulate data beyond the authenticated user's authorized scope rather than to achieve full database compromise or code execution. No EPSS data was provided, and neither a CISA KEV listing nor a publicly available POC was identified, indicating this is not currently being exploited broadly. IBM i environments are typically air-gapped or tightly access-controlled enterprise deployments, which further limits opportunistic exploitation. The practical risk is moderate and primarily concerns insider threat or compromised low-privilege accounts being escalated via SQL injection - organizations running Db2 Mirror for i should treat this as a scheduled patch priority rather than an emergency response.

An attacker with a valid low-privilege account on a network-accessible IBM Db2 Mirror for i 7.4-7.6 instance crafts an SQL payload embedding special characters or subqueries into an input field processed by the vulnerable component. The injected SQL executes in the database context, allowing the attacker to read rows outside their authorized scope or modify data in violation of configured security restrictions. No public exploit or POC exists at time of analysis; exploitation requires credential access.