Multiple Critical Vulnerabilities Patched in IBM Db2 Mirror for i
IBM has disclosed 18 vulnerabilities affecting the graphical user interface of its Db2 Mirror for i database synchronization product, which replicates Db2 for i databases across multiple systems. The most severe issue, CVE-2026-17186, carries a CVSSv3.1 base score of 9.9 and allows remote execution of arbitrary CL commands due to improper neutralization of specific elements within commands. Additional high-severity flaws include CVE-2026-17184 (CVSS 9.8) enabling arbitrary code execution through external file and path control, and CVE-2026-17182 (CVSS 9.8) permitting authentication bypass via URI path validation failures to access or modify sensitive data. Further issues encompass path traversal for writing files to arbitrary locations (CVE-2026-17181, CVSS 9.3) and an authorization bypass (CVE-2026-16879, CVSS 8.8). The vulnerabilities impact versions 7.6, 7.5, and 7.4, with fixes released in the August 11 security advisory.
Security NEXTAug 17, 2026Translated from Japanese