Db2 Mirror EUVD-2026-97815

Exploitation requires the attacker to already possess a valid authenticated account on an IBM i system where Db2 Mirror for i (version 7.4, 7.5, or 7.6) is installed and running - per the CVSS PR:L, low-level privileges suffice and no user interaction is needed. The core condition is the ability to submit a crafted request to the Db2 Mirror service that evades its additional authorization and input-validation checks; the description does not specify a non-default configuration toggle, so standard deployments of the affected versions appear exposed. The principal limiting factor is the authentication requirement: this is not remotely exploitable by fully unauthenticated attackers, which narrows the realistic threat to insiders, compromised accounts, or environments where low-privilege credentials are easily obtained.

This is a genuine high-priority vulnerability, though not a drop-everything emergency absent evidence of active exploitation. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) describes a network-reachable, low-complexity flaw requiring only low-level authenticated privileges and no user interaction, with a scope change that yields full confidentiality, integrity, and availability impact - the scope change plus privilege-escalation outcome is what pushes the score to 9.9. The vendor (IBM) reports a patch is available, but no EPSS score, SSVC decision data, KEV listing, or public POC is present in the input. There is no public exploit identified at time of analysis and no CISA KEV entry, so despite the near-maximum CVSS this currently reflects theoretical rather than demonstrated real-world exploitation. The signals are internally consistent (no conflict between CVSS network vector and the description's 'authenticated attacker' crafting a remote request). The main gap is the absence of exploitation-probability data (no EPSS) and SSVC automatability/technical-impact inputs, so prioritization should lean on the high intrinsic severity plus the fact that any authenticated Db2 Mirror for i user becomes a candidate attacker.

An attacker who already holds a low-privilege authenticated account on an IBM i system running Db2 Mirror crafts a malicious request that bypasses the product's additional authorization and input-validation checks, causing it to execute attacker-supplied code. Because of the scope change, the resulting code runs with elevated privileges beyond the attacker's original authorization, giving effective control of the system. No public exploit code is identified at time of analysis.