Description

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-14T20:16:49.817Z",
  "pubdate": "2026-08-14T20:16:49.817Z",
  "executiveSummary": "An improper authentication vulnerability exists within IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability exposes underlying system data due to flawed validation mechanics within the affected component. The risk implication involves the unauthorized disclosure of confidential operational and database-related information, potentially aiding further compromise of the database environment. Exploitation of this security flaw requires the attacker to possess remote authentication credentials to interact with the target service. No additional privilege requirements or complex interaction vectors are explicitly mandated beyond initial authentication. The impact is primarily confidentiality loss, compromising the integrity of the data enclave managed by IBM Db2 Mirror for i.",
  "technicalDetails": "The vulnerability resides in the authentication and authorization subsystems of IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. The root cause stems from improper authentication controls implemented during specific remote procedural handling or data retrieval requests, wherein the subsystem fails to adequately verify whether the authenticated principal possesses the precise authorization scope required to access the requested data structures. The vulnerable component processes client requests over the network protocol utilized by Db2 Mirror for database synchronization and high-availability management. Exploitation occurs when an attacker with valid remote authentication credentials issues specifically crafted database or management queries to the service. Because the application logic improperly validates session permissions or maps access control contexts, it bypasses granular authorization checks meant to restrict access to sensitive internal state or mirrored data sets. The attack flow proceeds as follows: First, the remote attacker authenticates to the target system using standard, valid credentials. Second, the attacker transmits a targeted request designed to interface with the Db2 Mirror subsystem. Third, due to the improper authentication validation flaw, the application processes the request without enforcing expected security boundaries. Finally, the service returns the requested sensitive information to the attacker, culminating in unauthorized data disclosure. Post-exploitation impact is constrained to the breadth of sensitive information accessible through the improperly guarded interfaces, which may include database configuration details, operational metadata, or mirrored transactional content."
}