What is the CVSS score of EUVD-2026-58797?

EUVD-2026-58797 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.6%.

Which versions of IBM Db2 Mirror are affected by EUVD-2026-58797?

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 contain a network-accessible path traversal vulnerability (CVSS 8.2) that allows unauthenticated remote attackers to write arbitrary files to system…. A patch is available.

How to fix or mitigate EUVD-2026-58797?

Within 24 hours: Identify all IBM i systems running Db2 Mirror versions 7.4, 7.5, or 7.6 in your environment using asset inventory systems. Within 7 days: Obtain and apply the patch available per vendor advisory from IBM to all affected production systems. Within 30 days: Complete patch deployment across all development and non-production systems, validate that file system access controls are functioning to prevent directory traversal, and document remediation completion with deployment dates and patch versions applied.

IBM Db2 Mirror EUVD-2026-58797

| CVE-2026-17081 HIGH

Path Traversal (CWE-22)

2026-08-14 ibm

GHSA-8hvx-mqvc-3w73

Path Traversal IBM Db2 Mirror For I

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

8.2 HIGH

Network-accessible service, no authentication per description and vendor report, arbitrary file write yields high integrity impact with minor availability side-effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVSS changed

Aug 20, 2026 - 21:37 NVD

8.2 (HIGH) 7.5 (HIGH)

Analysis Generated

Aug 14, 2026 - 20:26 vuln.today

CVE Published

Aug 14, 2026 - 19:19 nvd

HIGH 8.2

DescriptionNVD

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write arbitrary files due to improper limitation of a pathname to a restricted directory.

AnalysisAI

Arbitrary file write via path traversal in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes systems to unauthenticated remote exploitation. The flaw stems from improper pathname restriction (CWE-22), enabling an attacker to escape the intended directory sandbox and write files to arbitrary filesystem locations. No active exploitation has been confirmed in CISA KEV, and no public proof-of-concept exploit is known at the time of analysis, though the CVSS 8.2 High rating and network-accessible attack vector make this a credible priority for organizations running IBM i environments.

Technical ContextAI

IBM Db2 Mirror for i is a high-availability and disaster-recovery replication product designed for the IBM i (formerly AS/400) platform, enabling near-real-time mirroring of Db2 for i databases between systems. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. This class of flaw occurs when user-controlled input containing sequences such as '../' or encoded equivalents is not sanitized before being used to construct file system paths, allowing traversal outside a restricted root directory. The affected CPE is cpe:2.3:a:ibm:db2_mirror_for_i:*:*:*:*:*:*:*:* covering all sub-versions of releases 7.4, 7.5, and 7.6. Because Db2 Mirror for i operates as a network service facilitating replication, a writable endpoint exposed over the network is the likely attack surface.

RemediationAI

A vendor-released patch is available from IBM; apply the appropriate fix per the IBM support advisory at https://www.ibm.com/support/pages/node/7283359. No exact patched version number was disclosed in the available data - administrators should consult the advisory directly to identify the required Program Temporary Fix (PTF) for their IBM i release level (7.4, 7.5, or 7.6). As a compensating control prior to patching, restrict network access to Db2 Mirror for i replication endpoints using host-based packet rules or network firewall ACLs to permit connections only from known replication partner IP addresses; this directly limits the remote unauthenticated attack surface indicated by the CVSS vector. Note that ACL-based restriction does not eliminate the vulnerability and does not substitute for patching, but substantially reduces the realistic attacker pool in environments where the service cannot be immediately patched.