What is the CVSS score of EUVD-2026-58798?

EUVD-2026-58798 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.6%.

Is there a patch available for EUVD-2026-58798?

Yes, a patch is available for EUVD-2026-58798. Update the affected software to the latest version immediately.

Db2 Mirror for i EUVD-2026-58798

| CVE-2026-17173 MEDIUM

Path Traversal (CWE-22)

2026-08-14 ibm

GHSA-586h-382r-rc23

Path Traversal IBM Db2 Mirror For I

6.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible path traversal requiring low-privilege authentication; impact is strictly read-only file disclosure with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 20:36 vuln.today

DescriptionCVE.org

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of file paths.

AnalysisAI

Path traversal in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 exposes sensitive filesystem content to remote authenticated attackers via improper validation of user-supplied file paths. The CVSS 6.5 score (AV:N/AC:L/PR:L/UI:N) reflects network-accessible, low-complexity exploitation requiring only a low-privileged account, with high confidentiality impact and no integrity or availability loss. No active exploitation is confirmed (not listed in CISA KEV), no public proof-of-concept has been identified, and EPSS data was not present in the available intelligence.

Technical ContextAI

IBM Db2 Mirror for i is a high-availability replication solution operating on the IBM i platform (formerly AS/400 or iSeries), designed to synchronize database and object changes between paired IBM i systems in near-real-time. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal): the application fails to canonicalize or sanitize user-supplied file path inputs before using them in filesystem operations, allowing sequences such as '../' or absolute path references to escape the intended directory boundary and reach arbitrary files on the system. The affected CPE is cpe:2.3:a:ibm:db2_mirror_for_i:*:*:*:*:*:*:*:*, covering all minor revisions across versions 7.4, 7.5, and 7.6.

RemediationAI

Apply the vendor-supplied patch as documented in IBM's security bulletin at https://www.ibm.com/support/pages/node/7283359; this is the authoritative source for exact PTF numbers and fix levels across Db2 Mirror for i 7.4, 7.5, and 7.6. Patch availability is confirmed per IBM, but the specific patched version numbers were not included in the available intelligence - consult the bulletin directly before deploying. As a compensating control where immediate patching is not feasible, restrict network access to Db2 Mirror for i service endpoints to only trusted administrative hosts using IBM i authority controls or perimeter firewall rules, reducing the population of users who can reach the vulnerable path-handling functionality. Additionally, audit and remove any unnecessary low-privilege accounts with access to the Db2 Mirror environment to further constrain the authenticated attack surface. Note that network restriction does not eliminate the vulnerability if insiders or compromised accounts retain access.