What is the CVSS score of EUVD-2026-58794?

EUVD-2026-58794 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Is there a patch available for EUVD-2026-58794?

Yes, a patch is available for EUVD-2026-58794. Update the affected software to the latest version immediately.

IBM Db2 Mirror EUVD-2026-58794

| CVE-2026-16905 MEDIUM

Improper Authentication (CWE-287)

2026-08-14 ibm

GHSA-j7xj-v45c-v97f

Authentication Bypass IBM Db2 Mirror For I

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

MEDIUM

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.3 MEDIUM

IBM's description explicitly states 'remote authenticated attacker,' warranting PR:L over the official PR:N; impact is confined to low confidentiality with no integrity or availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Aug 20, 2026 - 21:52 NVD

5.3 (MEDIUM) 6.5 (MEDIUM)

Analysis Generated

Aug 14, 2026 - 20:36 vuln.today

DescriptionNVD

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication.

AnalysisAI

Sensitive information disclosure in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 stems from improper authentication (CWE-287), enabling remote attackers to retrieve data beyond their authorized scope. The official CVSS vector rates this as PR:N (no privileges required), yet IBM's own description qualifies the attacker as 'remote authenticated' - a direct conflict that security teams should resolve with the vendor before assuming exploitability by unauthenticated parties. IBM has released a patch and no public exploit code has been identified at time of analysis.

Technical ContextAI

IBM Db2 Mirror for i is a high-availability database mirroring solution designed for the IBM i (formerly iSeries/AS400) platform, providing near-real-time replication between primary and mirror nodes. The affected CPE is cpe:2.3:a:ibm:db2_mirror_for_i:*:*:*:*:*:*:*:*, spanning all sub-versions of 7.4, 7.5, and 7.6. CWE-287 (Improper Authentication) describes failures in authentication mechanisms that allow an actor to assume an identity without sufficient verification - in this context, the flaw likely manifests in the replication or administrative communication layer of Db2 Mirror, where authentication checks between nodes or clients are insufficiently enforced, permitting access to sensitive database contents or metadata.

RemediationAI

IBM has released a patch addressing this vulnerability; administrators should consult the official advisory at https://www.ibm.com/support/pages/node/7283359 for the exact fix version and PTF (Program Temporary Fix) details specific to IBM i. Until the patch is applied, compensating controls for IBM i environments include restricting network access to Db2 Mirror communication ports at the firewall or network layer to limit exposure to trusted internal subnets only, and auditing IBM i user profiles with access to Db2 Mirror administrative interfaces to ensure least-privilege assignment. Network segmentation to isolate mirror nodes from general-purpose network segments is an effective interim control with minimal operational side effects. Note that restricting Db2 Mirror network ports may affect replication latency if applied too broadly; coordinate with operations teams before implementing.