CVE-2026-17186 is a critical (CVSS 9.9) command injection in the IBM Db2 Mirror for i GUI. A remote attacker with no login could run arbitrary CL commands because special elements in a command are not neutralized. IBM lists PTFs for 7.4, 7.5 and 7.6 under 5770-DBM, so apply the one for your release.
What's affected
IBM i 7.4, 7.5 and 7.6 (as Db2 Mirror for i releases, with no 7.3 named in the bulletin), in the IBM Db2 Mirror for i GUI. IBM's security bulletin was first published on 11 August 2026.
IBM lists fixes as PTFs for license program 5770-DBM:
- IBM i 7.6: PTF SJ10948
- IBM i 7.5: PTF SJ10961
- IBM i 7.4: PTF SJ10947
IBM lists no workaround or mitigation for this issue. IBM also says to move off any unsupported release to a supported and fixed one.
How to check if you're exposed
Find your release and check whether the PTF for it is applied. On the IBM i command line, display the PTF status with the CL command below, using the PTF ID from the list above for your release.
DSPPTF LICPGM(5770DBM) SELECT(SJ10948)
A PTF that shows as permanently or temporarily applied counts as installed. One that is missing or only loaded needs action. Use the 5770-DBM license program ID in the command above, and confirm the Db2 Mirror GUI is not exposed to untrusted networks.
What to do now
- Identify every IBM i partition, including development and recovery systems, and record its release.
- Order and apply the PTF for your release from the table above, using IBM Fix Central or your usual PTF process.
- Block access to the Db2 Mirror GUI from untrusted networks until the PTF is applied.
- Confirm the PTF status again after the IPL, if one is required, and keep the result for your records.
Why it matters
The weakness is CWE-78 (OS Command Injection). A CL command was built from input that was not cleaned, so a remote attacker could change which command ran. CL commands are how IBM i is administered, so running arbitrary ones can mean control of the system.
The vector shows no privileges, no user interaction, low complexity and a changed scope, which is the pattern of a top-rated flaw. Db2 Mirror GUIs should not face untrusted networks. CISA does not list this CVE as known exploited.
Quick check
Which versions are covered?
IBM Db2 Mirror for i 7.4, 7.5 and 7.6. The PTFs are 5770-DBM: SJ10947 for 7.4, SJ10961 for 7.5 and SJ10948 for 7.6.
Sources
Last reviewed: 19 October 2026.
