IBM DB2 Mirror For I vulnerabilities

29 CVEs affecting IBM DB2 Mirror For I, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-96012, published 2026-10-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-17179, published 2026-08-14. Medium severity, CVSS 6.5. EPSS: 3.1% chance of exploitation in the next 30 days. IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service due to command injection.
CVE-2026-16956, published 2026-08-12. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
CVE-2026-18554, published 2026-08-14. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.
CVE-2026-16915, published 2026-08-14. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.
CVE-2026-17184, published 2026-08-14. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code due to external control of file name or path.
CVE-2026-17182, published 2026-08-14. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and obtain or alter sensitive information due to improper validation of request URI path segments.
CVE-2026-17173, published 2026-08-14. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of file paths.
CVE-2022-43928, published 2023-04-07. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. The IBM Toolbox for Java (Db2 Mirror for i 7.4 and 7.5) could allow a user to obtain sensitive information, caused by utilizing a Java string for processing. Since Java strings are immutable, their…
CVE-2026-17177, published 2026-08-14. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.
CVE-2026-17181, published 2026-08-14. High severity, CVSS 8.6. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write files to arbitrary locations due to path traversal.

Latest

CVE-2026-96012, published 2026-10-12. Critical severity, CVSS 9.9. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation…
CVE-2026-18104, published 2026-09-24. Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days. IBM Db2 Mirror for i 7.6, 7.5, and 7.4 could allow a local attacker to obtain sensitive information due to the use of the AES Electronic Codebook (ECB) mode for encryption.
CVE-2026-17047, published 2026-09-14. Medium severity, CVSS 5.4. EPSS: 0.1% chance of exploitation in the next 30 days. IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to improper request validation.
CVE-2026-17483, published 2026-09-04. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Db2 Mirror for i 7.4, 7.5, and 7.6 IBM i could allow a local attacker to delete historical flight-recorder archives due to improper access control in an SQL procedure.
CVE-2026-16660, published 2026-09-04. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
CVE-2026-18567, published 2026-09-04. Medium severity, CVSS 4.7. EPSS: 0.1% chance of exploitation in the next 30 days. IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involving a predictable Unix domain socket path in a world-writable directory.
CVE-2026-18178, published 2026-08-14. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to delete arbitrary files due to path traversal.
CVE-2026-17227, published 2026-08-14. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper neutralization of special elements used in an SQL command.
CVE-2026-17209, published 2026-08-14. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting.