IBM Db2 Mirror for i EUVD-2026-58795

Exploitation requires a valid authenticated session on IBM Db2 Mirror for i (per vendor description, despite PR:N in the official CVSS vector - this is a confirmed discrepancy). The attacker must be able to reach the Db2 Mirror for i network interface, and IBM i environments that expose this service to untrusted networks are at greater risk. Limiting factors include: authentication requirement (per vendor description), niche IBM i deployment environment, and the absence of a public exploit or active exploitation. The CVSS vector PR:N conflicts with the authenticated-attacker description; until IBM clarifies, assume authenticated access is required, which significantly limits exposure compared to the raw CVSS score suggests.

The official CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) scores 7.5 High and implies unauthenticated remote exploitation, but the vendor's own description explicitly states 'remote authenticated attacker' - a direct contradiction with PR:N. Security teams should treat PR:N as likely incorrect and assume authentication is required (PR:L or PR:H), which would reduce the base score to approximately 6.5. This discrepancy should be verified against the IBM advisory at the reference URL. No KEV listing and no POC have been identified, meaning EPSS-implied real-world exploitation risk is likely low. The niche deployment of IBM Db2 Mirror for i in IBM i environments further limits the attack surface. Overall, this is a credible but lower-immediate-priority issue once authentication requirements are confirmed - the PR:N assignment in the official vector appears inconsistent with the description.

An authenticated attacker with a valid IBM Db2 Mirror for i user account submits a crafted request containing directory traversal sequences (e.g., '../../') targeting a network-accessible Db2 Mirror interface. The application fails to sanitize the input path, allowing the attacker to read sensitive files outside the intended directory - such as IBM i IFS configuration files, stored credentials, or replicated database artifacts. No public exploit code exists at time of analysis.