CVE-2026-17081 is a high severity (CVSS 8.2) path traversal flaw in IBM Db2 Mirror for i 7.4, 7.5 and 7.6. A remote attacker with no account can write arbitrary files. IBM provides a PTF for each release under licensed program 5770-DBM.
What's affected
IBM Db2 Mirror for i on IBM i 7.4, 7.5 and 7.6, per IBM's bulletin and the record. IBM lists these fixes for 5770-DBM:
- IBM i 7.4: SJ10947
- IBM i 7.5: SJ10961
- IBM i 7.6: SJ10948
IBM lists workarounds and mitigations as None. The bulletin also covers CVE-2026-16708.
How to check if you're exposed
IBM i 7.3 through 7.6 are all in scope, so every supported and recently supported release needs a look. On each partition, confirm the installed release and then check whether the PTF for your release is loaded. From a command line:
DSPPTF LICPGM(5770DBM)
Look for the PTF number listed for your release in the table above, with a status of Applied or Permanently applied. You can also use option 10 of GO LICPGM to confirm the release. Do this on every LPAR, including test and recovery systems, because they are often patched last.
What to do now
- Locate every IBM i partition that has Db2 Mirror for i installed.
- Apply SJ10947, SJ10961 or SJ10948 for your release.
- Verify the PTF status with DSPPTF.
- Keep Db2 Mirror network ports reachable only from the mirror partners and administrators.
- Read IBM's bulletin 7283359 for any added instructions.
Why it matters
CWE-22 is path traversal. A path in a request is not confined to the directory the product meant, so the request can write outside it. The vector shows network access, low complexity, no privileges and no interaction, with high integrity and low availability impact.
Unauthenticated file write over the network is a serious combination, since written files can end up in places that are read or run later. Because the product replicates production databases, treat it as a priority patch and keep its network exposure narrow.
The weakness class here is CWE-22 (Path Traversal). The NVD record scores it 8.2, which is high severity. IBM's bulletin gives the same score. The CVSS vector reads attack vector over the network, low attack complexity, no privileges required, no user interaction. Scope is unchanged. Impact on confidentiality, integrity and availability is rated none, high and low. The record's KEV flag is false, so this CVE is not in CISA's Known Exploited Vulnerabilities catalog, and the advisory I fetched does not report exploitation.
Try it yourself
A free in-browser dependency scan at gold.safeguard.sh/scan shows which of your components match known CVEs. The demo below walks through the idea.
Click through it at your own pace, or open it full screen.
Quick check
Does the attacker need an account?
No. The vector shows no privileges required, which is why network restriction matters until the PTF is on.
Sources
- IBM security bulletin for Db2 Mirror for i
- Safeguard Gold entry for CVE-2026-17081, which summarizes the NVD record
Last reviewed: 18 October 2026.
