IBM Db2 Mirror for i EUVD-2026-58796

Exploitation requires a valid low-privilege authenticated session on an IBM Db2 Mirror for i 7.4, 7.5, or 7.6 instance (confirmed by PR:L in the CVSS vector). The attack is network-delivered (AV:N) with low complexity (AC:L) and requires no user interaction (UI:N). The critical enabling condition is knowledge of the specific request parameter that triggers the server to disable input validation - this parameter must exist and be accepted by the Mirror management interface. No scope change occurs (S:U), meaning impact is confined to the Db2 Mirror component itself. Exploitation is limited by the authentication requirement: unauthenticated or anonymous attackers cannot exploit this flaw. Non-default or specialized Mirror configurations are not cited as prerequisites; any standard deployment of the affected versions appears exposed to authenticated users with network access.

The IBM-assigned CVSS 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) is consistent with a remotely exploitable, low-complexity flaw requiring only a low-privilege authenticated session with no user interaction. All three impact dimensions (C, I, A) are rated Low, indicating bounded but real risk across confidentiality, integrity, and availability - likely reflecting that what becomes exploitable after bypassing validation depends on downstream controls. No EPSS score was provided in the input data, preventing a statistical exploitation-probability comparison. There is no CISA KEV listing and no public proof-of-concept identified, which reduces immediate urgency. The primary real-world concern is that disabling input validation may open the path to secondary attacks (injection, data corruption) whose severity exceeds this CVE's own score; defenders should assess what validation is bypassed and what downstream operations consume the unvalidated input. SSVC signals: exploitation is undemonstrated, the attack is not trivially automatable given the authentication requirement (PR:L), and technical impact is partial - suggesting a defer-to-scheduled-patching posture for most organizations unless sensitive data flows through this replication path.

An attacker holding a low-privilege account on an IBM i environment with Db2 Mirror enabled submits a crafted HTTP or application-layer request that includes a parameter instructing the server to disable its input validation pipeline. With validation suppressed, the attacker then sends a follow-on request containing malicious or out-of-bounds input - potentially triggering data corruption, unauthorized data access, or service degradation depending on what the bypassed validation was guarding. No public proof-of-concept has been identified at time of analysis, but the straightforward nature of the bypass (a single request parameter) means exploitation requires minimal technical sophistication once the parameter is known.