9.9 CVSS: Authenticated Attackers Can Execute Arbitrary Code in IBM Db2 Mirror for i 7.4-7.6 via CVE-2026-96012
A critical flaw in IBM Db2 Mirror for i versions 7.4 through 7.6 permits authenticated attackers to bypass checks and execute arbitrary code on the system.
Key points
- The flaw, CVE-2026-96012, carries a CVSS score of 9.9, rated critical by the National Vulnerability Database.
- IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 are affected by this privilege escalation vulnerability.
- An attacker must first authenticate to the system before crafting the malicious request that triggers the exploit.
IBM Db2 Mirror for i contains a critical vulnerability that allows authenticated attackers to execute malicious code on affected systems, according to the National Vulnerability Database. The flaw, identified as CVE-2026-96012, enables privilege escalation by bypassing essential security controls within the database mirroring software.
The National Vulnerability Database assigns this issue a CVSS score of 9.9, marking it as critical. The weakness stems from insufficient authorization and input validation checks, allowing crafted requests to circumvent normal security boundaries and gain elevated system privileges.
Technical Mechanics
The vulnerability is classified under CWE-264, which relates to permission, privilege, and access control issues. An attacker must first obtain valid credentials to access the IBM Db2 Mirror for i environment. Once authenticated, they can send a specially constructed request that the system fails to properly validate.
This failure in validation allows the attacker to execute arbitrary code on the host system. The successful exploitation results in elevated privileges, giving the attacker deeper control over the database environment than their initial account permissions would normally allow.
Affected Components
Only specific versions of the software are susceptible to this attack vector. IBM Db2 Mirror for i version 7.4 is affected by CVE-2026-96012, as are versions 7.5 and 7.6. Systems running other versions or different IBM products are not listed as vulnerable in this specific advisory.
Small-business owners using these specific legacy or current versions for database replication should verify their installed version immediately. The risk is present in any deployment where these three versions are active and accessible to authenticated users, including internal staff or external partners with legitimate access.
Defender's checklist
No official patch or security update has been confirmed for these versions in the available source material. Administrators should audit user access logs for unusual activity that might indicate exploitation attempts. Monitoring for unexpected privilege changes or unauthorized code execution is essential while awaiting a vendor resolution.
Background: Privilege escalation vulnerabilities
Privilege escalation vulnerabilities allow attackers to gain unauthorized access to higher-level system permissions. These flaws bypass security controls by exploiting misconfigurations or unpatched software. You must enforce least privilege and audit permissions regularly to prevent attackers from moving laterally and taking control of your critical assets.
Read the full guide: Privilege Escalation Vulnerabilities: How Attackers Steal Admin Control
What to do and how to stay safe: IBM
- Verify the exact version of IBM Db2 Mirror for i installed on your servers to determine if you are using 7.4, 7.5, or 7.6.
- Restrict access to the database mirroring service to only essential, trusted administrators to reduce the pool of potential attackers.
- Monitor system logs for signs of privilege escalation or unexpected code execution, particularly from authenticated accounts with limited permissions.
- Prepare to isolate affected systems from the network if suspicious activity is detected, once the vendor provides an update.
Step-by-step guide: Patch Management vs Vulnerability Management: The Critical Distinction
General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-96012?
The National Vulnerability Database rates CVE-2026-96012 with a CVSS score of 9.9, which is classified as critical severity.
Which IBM Db2 Mirror for i versions are vulnerable?
Versions 7.4, 7.5, and 7.6 of IBM Db2 Mirror for i are affected by this privilege escalation vulnerability.
Does an attacker need to be authenticated to exploit this?
Yes, the source material states that an authenticated attacker can craft a malicious request to exploit this vulnerability.
