CVE-2026-17182
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and obtain or alter sensitive information due to improper validation of request URI path segments.
Risk Assessment
An unauthenticated attacker can access or modify sensitive data, posing a serious security breach.
Recommendation
Apply patches from IBM for Db2 Mirror for i versions 7.4, 7.5, and 7.6.
Other vulnerabilities in IBM Db2 Mirror for i
See all- CVE-2026-17186Critical
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL commands due to improper neutralization of special elements in a command.
- CVE-2026-17184Critical
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code due to external control of file name or path.
- CVE-2026-17181Critical
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a remote attacker to write files to arbitrary locations due to path traversal.
- CVE-2026-16956Critical
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
- CVE-2026-18104Low
IBM Db2 Mirror for i versions 7.6, 7.5, and 7.4 could allow a local attacker to obtain sensitive information due to the use of the AES Electronic Codebook (ECB) mode for encryption.
- CVE-2026-17047Medium
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 may allow a remote attacker to obtain sensitive information due to improper request validation.
- CVE-2026-17483Medium
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a local attacker to delete historical flight-recorder archives due to improper access control in an SQL procedure.
- CVE-2026-16660Medium
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
- CVE-2026-18567Medium
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involving a predictable Unix domain socket path in a world-writable directory.
- CVE-2026-18554High
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.
Original NVD description (English source)
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and obtain or alter sensitive information due to improper validation of request URI path segments.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS