IBM disclosed a critical (CVSS 9.3) path traversal flaw in Db2 Mirror for i that lets an unauthenticated remote attacker write files to arbitrary locations on the affected system.
What Is It
CVE-2026-17181 is a path traversal vulnerability (CWE-22) in IBM Db2 Mirror for i. Per IBM's PSIRT advisory, the flaw "could allow a remote attacker to write files to arbitrary locations due to path traversal." IBM assigned it a CVSS 3.1 base score of 9.3 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L.
The vector breakdown is what makes this one notable: network attack vector, low attack complexity, no privileges required, and no user interaction. Scope is marked as Changed, meaning the impact extends beyond the vulnerable component's own security authority. Impact is rated High for integrity and Low for availability, with no confidentiality impact; consistent with an arbitrary file write primitive rather than a read or disclosure bug.
Why It Matters
An unauthenticated, remote arbitrary file write with a changed scope is a strong foothold. Attacker-controlled content landing at attacker-chosen paths is the classic precursor to persistence or code execution, and the exploitability subscore here is the maximum 3.9. Db2 Mirror for i underpins continuous availability for IBM i database environments, so the systems running it are typically ones an organization cannot casually take offline.
As of this writing, CVE-2026-17181 does not appear in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no public reporting of active exploitation has surfaced. The KEV catalog is updated continuously; check it directly (linked below) before treating that status as current.
What's Vulnerable
IBM Db2 Mirror for i, versions:
- 7.4 (including 7.4.0)
- 7.5 (including 7.5.0)
- 7.6 (including 7.6.0)
No other IBM products are named in the CVE record.
Patch Status
The CVE was published 2026-08-14 and currently sits in NVD vulnStatus: Received, meaning NVD analysis is not yet complete. IBM's PSIRT is the source identifier and has published a support advisory (node 7283359) as the sole reference. The NVD record does not enumerate fixed version numbers or a specific required action; consult the IBM advisory directly for the applicable PTF or fix level for your release.
Sources
- NVD, CVE-2026-17181: https://nvd.nist.gov/vuln/detail/CVE-2026-17181
- IBM Support (PSIRT advisory): https://www.ibm.com/support/pages/node/7283359
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog