CVE-2026-18178 is a medium severity (CVSS 5.4) path traversal flaw in IBM Db2 Mirror for i 7.4, 7.5 and 7.6. A remote authenticated attacker can delete arbitrary files. IBM fixes it with 5770-DBM PTFs SJ10947 (7.4), SJ10961 (7.5) and SJ10948 (7.6) and lists no workaround.
What's affected
IBM Db2 Mirror for i 7.4, 7.5 and 7.6 are affected. IBM's bulletin gives these fixes for product 5770-DBM:
- 7.4: SJ10947
- 7.5: SJ10961
- 7.6: SJ10948
PTFs are available through IBM Fix Central. The same bulletin covers 18 CVEs with base scores from 5.3 to 9.9, so a Db2 Mirror system that is behind on this bulletin may be missing more than this one fix. The record scores this CVE 5.4, and the bulletin notes that your environmental score depends on your own setup.
How to check if you're exposed
On each system that runs Db2 Mirror for i, check whether the PTF for your release is applied:
DSPPTF LICPGM(5770DBM) SELECT(SJ10948)
Substitute the PTF number for your release. A status of applied means the fix is in place. If the display is unclear, use IBM's PTF documentation to confirm.
Because the attack needs a valid login, also review which user profiles can reach the Db2 Mirror services and whether any are shared or unused.
What to do now
- Identify all Db2 Mirror for i nodes and their releases.
- Download and apply the PTF for each release from IBM Fix Central.
- Apply the other PTFs in the same bulletin, since it covers 18 CVEs and some score as high as 9.9.
- Review and remove unused user profiles with access to Db2 Mirror.
- Make sure backups of critical files are current before and after the change.
Why it matters
The weakness class is CWE-22, path traversal, also described as improper limitation of a pathname to a restricted directory. When a service builds a file path from input and does not confine it to the intended folder, relative path segments can move the operation outside that folder. Here the operation is deletion, so the main impact is on integrity and availability of files on the system.
The score is moderate because the attacker needs credentials and the impacts are low to moderate. A deleted configuration or data file can still cause an outage on a mirrored database environment, so apply the PTF with the rest of the bulletin. The KEV flag is false and IBM does not state that the flaw is exploited.
Quick check
Why should I apply the whole bulletin and not just this fix?
The IBM bulletin covers 18 CVEs, including one scored 9.9. The PTFs are delivered together, so applying them closes all of those.
Does the attacker need to log in?
Yes. The record describes a remote authenticated attacker.
Sources
Last reviewed: 18 October 2026.
