CVE-2026-96012 is a critical privilege escalation flaw in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. An authenticated attacker can use it to run malicious code and gain elevated privileges on the system.
What Is It
IBM's PSIRT reported CVE-2026-96012, and NVD published it on October 12, 2026. According to the vendor description, an authenticated attacker can send a specially crafted request that gets around extra authorization and input validation checks. That lets the attacker run malicious code and gain elevated privileges on the system.
The flaw is classified as CWE-264 (Permissions, Privileges, and Access Controls). The NVD record's status is "Received," which means NVD has not finished analyzing it yet.
Why It Matters
IBM gave the flaw a CVSS v3.1 base score of 9.9 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In plain terms:
- Exploitable over the network with low attack complexity
- Needs only low privileges and no user interaction
- Changed scope, so a successful attack can affect resources beyond the vulnerable component
- High impact on confidentiality, integrity, and availability
The attacker does need valid credentials. But once logged in, even a low-privileged user could take over the system. That makes the flaw a serious concern for insider threats and for attackers who have stolen credentials.
Exploitation status: When this brief was published, CVE-2026-96012 was not in CISA's Known Exploited Vulnerabilities (KEV) catalog, so it has no federal remediation deadline. A missing KEV listing does not prove the flaw hasn't been exploited. It only means CISA has not confirmed exploitation. Check the KEV catalog again for updates.
What's Vulnerable
IBM lists these product versions as affected:
| Vendor | Product | Affected Versions |
|---|---|---|
| IBM | Db2 Mirror for i | 7.4 (7.4.0) |
| IBM | Db2 Mirror for i | 7.5 (7.5.0) |
| IBM | Db2 Mirror for i | 7.6 (7.6.0) |
Patch Status
The NVD record links to an IBM support page for this vulnerability (node 7290193). This brief does not confirm specific fix versions, PTF numbers, or workarounds. Administrators running affected versions should read the IBM bulletin directly. It will show whether fixes or mitigations are available, which ones apply to their release, and how to install them.
Until remediation is confirmed, keep a close eye on authenticated access to Db2 Mirror for i, since the flaw requires an attacker to be logged in.