IBM Db2 Mirror for i Remote Code Execution via Path Control Vulnerability

Technical Analysis

CVE-2026-17184 stems from improper validation of externally-controlled file names or paths within IBM Db2 Mirror for i, a component used to synchronize database replicas across IBM i partitions for high availability. An attacker can manipulate path or filename inputs to reference unintended files or directories, potentially leading to arbitrary code execution in the context of the Db2 Mirror process, which typically runs with elevated privileges on IBM i systems. The vulnerability is remotely exploitable without authentication complexity noted in the CVSS 9.8 vector, suggesting network-based access with no user interaction required, making it highly attractive for automated exploitation and worming. Organizations running RAG pipelines or AI agent backends that rely on IBM i / Db2 for structured data storage or retrieval could face data integrity compromise, credential exposure, or full host takeover if agent orchestration services share infrastructure with vulnerable Db2 Mirror instances.

Affected Systems

IBM Db2 Mirror for i running on IBM i operating system versions 7.4, 7.5, and 7.6; any environment using Db2 Mirror for high-availability database replication in these releases.

Indicators of Compromise

• No specific IOCs published at time of disclosure; monitor IBM i system logs (QHST, QSYSOPR message queue) for anomalous Db2 Mirror process behavior and unexpected file access patterns in mirrored database paths.

Remediation Steps

1. 1

   Apply IBM Security Patch

   Monitor IBM PSIRT advisories and apply the official fix or PTF (Program Temporary Fix) for CVE-2026-17184 as soon as it is released for affected 7.4/7.5/7.6 releases.

2. 2

   Restrict Network Access

   Limit network exposure of Db2 Mirror communication ports to trusted, segmented internal networks only, using firewalls or VLAN isolation.

3. 3

   Validate Input Paths

   Where configurable, enforce strict allow-listing of file paths and names used by Db2 Mirror processes to prevent path traversal or injection.

4. 4

   Monitor and Audit

   Enable enhanced logging on IBM i systems to detect anomalous file access or process execution tied to Db2 Mirror services.

5. 5

   Isolate Dependent Services

   For organizations running AI agent or RAG infrastructure with backend ties to Db2 on IBM i, segment these services from mirrored database hosts until patched to limit lateral compromise risk.