CVE-2026-17184 affects IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. The vulnerability arises from improper handling of file names or paths that can be externally controlled by an attacker. This flaw allows remote code execution without requiring privileges or user interaction. The weakness corresponds to CWE-73, which involves external control of file names or paths leading to potential arbitrary code execution. The CVSS score of 9.8 reflects the critical nature of this vulnerability, with high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system, potentially leading to full compromise of the IBM Db2 Mirror for i environment. The attacker does not need any privileges or user interaction to exploit this flaw, making it highly dangerous. The impact includes complete loss of confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There is no official fix or patch information provided at this time. Users should monitor IBM's security advisories for updates and apply any official patches once available. Until a patch is released, consider restricting network access to the affected service to trusted sources only.