CVE-2026-16708 is a high severity (CVSS 8.3) flaw in IBM Db2 Mirror for i 7.4, 7.5 and 7.6, caused by external control of system configuration. A remote attacker could obtain sensitive information. IBM provides a PTF for each release and lists no workaround.
What's affected
IBM Db2 Mirror for i on IBM i 7.4, 7.5 and 7.6, per IBM's bulletin and the record. The bulletin lists these fixes for licensed program 5770-DBM:
- IBM i 7.4: SJ10947
- IBM i 7.5: SJ10961
- IBM i 7.6: SJ10948
IBM lists workarounds and mitigations as None. The same bulletin covers CVE-2026-17081, a path traversal issue in the same product.
How to check if you're exposed
IBM i 7.3 through 7.6 are all in scope, so every supported and recently supported release needs a look. On each partition, confirm the installed release and then check whether the PTF for your release is loaded. From a command line:
DSPPTF LICPGM(5770DBM)
Look for the PTF number listed for your release in the table above, with a status of Applied or Permanently applied. You can also use option 10 of GO LICPGM to confirm the release. Do this on every LPAR, including test and recovery systems, because they are often patched last.
What to do now
- Find every IBM i partition that has Db2 Mirror for i installed.
- Order and apply the PTF for your release: SJ10947, SJ10961 or SJ10948.
- Check the status with DSPPTF and record it.
- Restrict network access to Db2 Mirror management and replication paths to the hosts that need it.
- Read IBM's bulletin 7283359 for any extra instructions that come with the PTFs.
Why it matters
CWE-15 is external control of system or configuration setting. Something outside the trust boundary can influence a setting that the system relies on. IBM does not say which setting, and the record only says the result is exposure of sensitive information.
The vector shows user interaction is required and scope is changed, with high impact on confidentiality, integrity and availability. That combination means a successful attack could reach beyond Db2 Mirror itself. Mirror setups hold replicated production data, so keep the PTF high on the list.
The weakness class here is CWE-15 (External Control of System or Configuration Setting). The NVD record scores it 8.3, which is high severity. IBM's bulletin gives the same score. The CVSS vector reads attack vector over the network, high attack complexity, no privileges required, user interaction required. Scope is changed, meaning the impact can reach beyond the vulnerable component. Impact on confidentiality, integrity and availability is rated high, high and high. The record's KEV flag is false, so this CVE is not in CISA's Known Exploited Vulnerabilities catalog, and the advisory I fetched does not report exploitation.
Safeguard's Gold directory tracks this CVE, and reachability analysis helps you decide which affected components matter most for your own software.
Quick check
Do I need the PTF if I only use Db2 Mirror in a test environment?
Yes if the product is installed on an affected release. Test systems often hold copies of real data and share network paths with production, so patch them too.
Sources
- IBM security bulletin for Db2 Mirror for i
- Safeguard Gold entry for CVE-2026-16708, which summarizes the NVD record
Last reviewed: 18 October 2026.
