CVE-2026-18104: IBM Db2 Mirror for i is vulnerable to obtain sensitive information []
Published Sep 23, 2026
·Updated
IBM Db2 Mirror for i 7.6, 7.5, and 7.4 could allow a local attacker to obtain sensitive information due to the use of the AES Electronic Codebook (ECB) mode for encryption.
Other sources
IBM i could allow a local attacker to obtain sensitive information due to the use of the AES Electronic Codebook (ECB) mode for encryption.
— IBM
Affected Software
5 affected components
IBM Db2 Mirror for i=7.6, =7.5, =7.4
IBM Db2 Mirror for i<=7.6
IBM Db2 Mirror for i<=7.5
IBM Db2 Mirror for i<=7.4
IBM Db2 Mirror for i>=7.4<=7.6
Event History
Sep 23, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Sep 24, 2026
CVE Published
via MITRE·02:11 PM
Data Sourced
via MITRE·02:11 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·02:17 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
An attacker needs local access and low privileges. No user interaction is required.
2
Which deployments are identified as affected?
IBM Db2 Mirror for i versions 7.6, 7.5, and 7.4 are identified as affected.
3
What is the expected impact?
The issue may allow disclosure of sensitive information. The provided severity vector indicates no integrity or availability impact.