IBM Db2 Mirror for i EUVD-2026-71468

Exploitation requires a valid authenticated IBM i account with at least low-level database session access (CVSS PR:L). The description states 'local attacker,' implying the account must be a local IBM i system user - but this conflicts with CVSS AV:N, which suggests the SQL procedure may be reachable over network database connections; IBM should be consulted to resolve this discrepancy. The vulnerable SQL procedure for flight-recorder management must be invocable from the attacker's session (i.e., not already restricted by object authority). Exploitation is strictly limited to deletion of flight-recorder archives - there is no confidentiality exposure, no code execution path, and no lateral impact to other Db2 Mirror nodes. The flaw affects only Db2 Mirror for i 7.4, 7.5, and 7.6; other IBM i Db2 editions and Db2 for LUW are not affected.

The IBM-assigned CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, score 4.3) classifies this as moderate severity with network attack vector and low-privilege requirement. However, there is a significant discrepancy: the description explicitly states 'local attacker,' which conflicts with CVSS AV:N - the true attack vector should be confirmed against the IBM advisory at node/7285904. Additionally, the I:N assignment appears to understate the real consequence: permanent deletion of diagnostic archives is a data-integrity loss, not merely an availability reduction, suggesting I:L is more accurate. No EPSS data was provided; no CISA KEV listing or proof-of-concept exploit is indicated, so no public exploit has been identified at time of analysis. Real-world risk is highest in regulated IBM i environments (banking, manufacturing, healthcare) where flight-recorder archives serve as tamper-evident audit evidence - an insider or post-breach attacker wiping these records could impede forensic investigation and trigger compliance violations. Exploitation complexity is low once credentials are obtained, but the limited attack surface (IBM i deployments with Db2 Mirror enabled) constrains overall exposure.

An authenticated IBM i user with minimal database privileges - such as an application service account or disgruntled insider - connects to the Db2 Mirror for i instance and directly invokes the unprotected SQL procedure responsible for deleting flight-recorder archives. Because the procedure performs no authority verification (CWE-285), the call succeeds without elevated rights, permanently destroying the historical diagnostic records that replication administrators rely on for troubleshooting and post-breach forensic review. No public exploit code has been identified at time of analysis.