IBM Db2 Mirror for i: Privilege escalation in the GUI
Summary
IBM Db2 Mirror for i 7.4, 7.5 and 7.6 contains a privilege escalation flaw in the Db2 Mirror GUI (CWE-264). An authenticated attacker with a valid user account can send a crafted request that bypasses authorization and input validation checks, execute malicious code and obtain elevated privileges on the IBM i system. IBM rates the vulnerability 9.9 (Critical). Fixes are available and no exploitation is known.
Affected
- IBM Db2 Mirror for i 7.4
- IBM Db2 Mirror for i 7.5
- IBM Db2 Mirror for i 7.6
- Versions 7.3 and earlier: not listed as affected in the sources; confirm with IBM.
Fixed in
- Db2 Mirror for i 7.4: PTF SJ11623
- Db2 Mirror for i 7.5: PTF SJ11624
- Db2 Mirror for i 7.6: PTF SJ11625
Workaround
Unknown. IBM lists no workaround or mitigation. Apply the PTFs.
Exploitation
- No known exploitation in the wild
- CISA SSVC: exploitation none, not automatable
- No public proof of concept found
Our recommendation
- Apply PTF SJ11623 (7.4), SJ11624 (7.5) or SJ11625 (7.6) now, at the latest in the next maintenance window
- Restrict access to the Db2 Mirror GUI to administrator networks
- Review user accounts on IBM i and remove unused or stale accounts
- Check whether the GUI is reachable from the internet and block any inbound route
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin CVE-2026-96012 www.ibm.com
- OpenCVE CVE-2026-96012 app.opencve.io
- VulDB entry 417206 vuldb.com
- Securityonline report securityonline.info
- IT Jungle PTF guide www.itjungle.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:31.
Original description (NVD)
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker could exploit this vulnerability to obtain elevated privileges on the system.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.