Threat Intelligence Database

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 contain a path traversal vulnerability that allows a remote authenticated attacker to delete arbitrary files. This vulnerability is identified as CWE-22 and has a CVSS 3.1 base score of 5.4, indicating a medium severity level. The flaw arises from improper limitation of a pathname to a restricted directory, enabling unauthorized file deletion. No official patch or remediation guidance has been provided yet by IBM. There are no known exploits in the wild at this time.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 contain a vulnerability where improper neutralization of special elements in SQL commands could allow a remote authenticated attacker to bypass security restrictions. This vulnerability is classified as an SQL Injection (CWE-89) and has a medium severity with a CVSS score of 5.4. No official patch or remediation guidance has been provided yet.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 contain a critical vulnerability (CVE-2026-17186) that allows remote attackers to execute arbitrary CL commands due to improper neutralization of special elements in commands. This OS command injection flaw can lead to significant impact including loss of availability and integrity. The vulnerability has a CVSS score of 9.9, indicating critical severity. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

CVE-2026-17184 is a critical vulnerability in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. It involves external control of file name or path, which could allow a remote attacker to execute arbitrary code without any privileges or user interaction. The vulnerability has a CVSS score of 9.8, indicating a high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-17182 is a critical vulnerability in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. It allows a remote attacker to bypass authentication due to improper validation of request URI path segments, potentially leading to unauthorized access and modification of sensitive information.

CVE-2026-17175 is a high-severity vulnerability in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. It involves improper authentication enforcement that could allow a remote unauthenticated attacker to obtain sensitive information. The vulnerability does not impact integrity or availability but has a significant confidentiality impact. No official patch or remediation guidance has been published yet, and no known exploits are reported in the wild.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 contain a vulnerability that allows a remote authenticated attacker to bypass security restrictions by disabling server-side input validation through a request parameter. This flaw is categorized as a protection mechanism failure (CWE-693). The vulnerability has a medium severity with a CVSS score of 6.3.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 contain a path traversal vulnerability (CWE-22) that allows a remote unauthenticated attacker to obtain sensitive information due to improper input validation. The vulnerability has a high severity with a CVSS score of 7.5. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 contain an improper authentication vulnerability that could allow a remote unauthenticated attacker to obtain sensitive information. The vulnerability does not impact integrity or availability but may lead to information disclosure. The CVSS score is 5.3, indicating a medium severity level. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 contain an improper authorization vulnerability that could allow a remote authenticated attacker to bypass security restrictions using user-supplied input. This vulnerability has a high severity with a CVSS score of 8.8, indicating a significant risk to confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor.