Security Bulletin: IBM Db2 Mirror for i is vulnerable to obtain sensitive information [CVE-2026-18104]

Summary IBM Db2 Mirror for i is vulnerable to obtaining sensitive information CVE-2026-18104 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-18104 DESCRIPTION: IBM i could allow a local attacker to obtain sensitive information due to the use of the AES...

CVE-2026-18104

IBM Db2 Mirror for i 7.6, 7.5, and 7.4 could allow a local attacker to obtain sensitive information due to the use of the AES Electronic Codebook ECB mode for encryption...

CVE-2026-18104 IBM Db2 Mirror for i is vulnerable to obtain sensitive information []

IBM Db2 Mirror for i 7.6, 7.5, and 7.4 could allow a local attacker to obtain sensitive information due to the use of the AES Electronic Codebook ECB mode for encryption...

CVE-2026-18104 IBM Db2 Mirror for i is vulnerable to obtain sensitive information []

IBM Db2 Mirror for i 7.6, 7.5, and 7.4 could allow a local attacker to obtain sensitive information due to the use of the AES Electronic Codebook ECB mode for encryption...

EUVD-2026-85892

IBM Db2 Mirror for i 7.6, 7.5, and 7.4 could allow a local attacker to obtain sensitive information due to the use of the AES Electronic Codebook ECB mode for encryption...

CVE-2026-18104

IBM Db2 Mirror for i versions 7.6, 7.5, and 7.4 are vulnerable to the disclosure of sensitive information. The root cause is the use of the AES Electronic Codebook (ECB) mode for encryption, which is considered a broken or risky cryptographic algorithm (CWE-327 ). This issue allows a local attack...

CVE-2026-18104: Use of a Broken or Risky Cryptographic Algorithm

IBM Db2 Mirror for i 7.6, 7.5, and 7.4 could allow a local attacker to obtain sensitive information due to the use of the AES Electronic Codebook ECB mode for encryption...

PT-2026-97811

Name of the Vulnerable Software and Affected Versions IBM Db2 Mirror for i versions 7.4 through 7.6 Description A local attacker could obtain sensitive information because the software uses AES Electronic Codebook ECB mode for encryption. ECB is a block cipher mode that encrypts identical blocks ...

CVE-2026-17047

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 are vulnerable to Cross-Site Request Forgery (CWE-352) in its GUI due to improper request validation. A remote attacker can exploit this to obtain sensitive information and cause low integrity impact (CVSS 5.4, MEDIUM). No specific exploit or in-the...

CVE-2026-17047: Cross-Site Request Forgery (CSRF)

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to improper request validation...

CVE-2026-17483

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 IBM i could allow a local attacker to delete historical flight-recorder archives due to improper access control in an SQL procedure...

CVE-2026-18567: Time-of-check Time-of-use (TOCTOU) Race Condition

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involving a predictable Unix domain socket path in a world-writable directory...

CVE-2026-17483: Improper Authorization

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 IBM i could allow a local attacker to delete historical flight-recorder archives due to improper access control in an SQL procedure...

CVE-2026-16660: Out-of-bounds Read

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds read...

CVE-2026-17209

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting...

CVE-2026-17186

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL commands due to improper neutralization of special elements in a command...

CVE-2026-18554

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...

CVE-2026-18178

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to delete arbitrary files due to path traversal...

CVE-2026-17179

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service due to command injection...

CVE-2026-17173

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of file paths...