IBM disclosed a critical authentication bypass in Db2 Mirror for i that lets an unauthenticated remote attacker read or modify sensitive information by abusing improper validation of request URI path segments.
What Is It
CVE-2026-17182 is an improper authentication flaw (CWE-287) in IBM Db2 Mirror for i. According to IBM's advisory, the product fails to properly validate request URI path segments, allowing a remote attacker to bypass authentication and then obtain or alter sensitive information.
IBM PSIRT rates it CVSS 3.1 base score 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, exploitability subscore 3.9, impact subscore 5.9.
Why It Matters
The CVSS vector describes the worst-case profile for an internet-reachable service: network attack vector, low attack complexity, no privileges required, and no user interaction. Impact is high across all three of confidentiality, integrity, and availability.
Db2 Mirror for i is a database replication technology for IBM i environments, so a pre-authentication bypass targets the control plane sitting in front of production data. The description explicitly covers both reading and altering sensitive information, meaning this is not a disclosure-only issue.
This CVE is not currently listed in the CISA KEV catalog: no supplied source material confirms active exploitation, and no KEV remediation deadline or required action applies at this time. That absence should not be read as low urgency given the score and the pre-auth attack path.
What's Vulnerable
IBM Db2 Mirror for i, versions:
- 7.4 (including 7.4.0)
- 7.5 (including 7.5.0)
- 7.6 (including 7.6.0)
All three release lines are flagged as affected in the NVD record. No unaffected or fixed version numbers are enumerated in the supplied data.
Patch Status
The CVE was published 2026-08-14 with a vulnStatus of Received, meaning NVD enrichment is still pending. IBM's advisory (support node 7283359) is the single authoritative reference supplied and should be consulted directly for fix levels, PTFs, and any interim mitigations; no patch identifiers or workarounds are included in the NVD data itself.
Operators running 7.4, 7.5, or 7.6 should treat this as priority remediation and restrict network exposure of Db2 Mirror interfaces pending patch application.
Sources
- IBM Security Advisory (PSIRT), https://www.ibm.com/support/pages/node/7283359
- NVD, CVE-2026-17182, https://nvd.nist.gov/vuln/detail/CVE-2026-17182