CVE-2026-18554 is a path traversal vulnerability (CWE-22) in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. The flaw allows remote attackers without privileges to bypass pathname restrictions and access sensitive information outside intended directories. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No official remediation or patch information is currently available.

Successful exploitation could lead to unauthorized disclosure of sensitive information by accessing files outside the restricted directory structure. The vulnerability does not affect integrity or availability but compromises confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected service and monitor for suspicious activity related to file access attempts.