CVE-2026-18178 is a path traversal vulnerability in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. It allows a remote attacker with valid authentication to delete arbitrary files on the system by exploiting improper validation of file paths. The vulnerability impacts the integrity and availability of the affected system but does not compromise confidentiality. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact.

An authenticated remote attacker can delete arbitrary files on systems running IBM Db2 Mirror for i 7.4, 7.5, and 7.6. This can lead to denial of service or disruption of normal operations due to loss of critical files. There is no direct impact on confidentiality, but integrity and availability are affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, restrict access to trusted users and monitor for suspicious activity related to file deletions.