CVE-2026-96012: IBM Db2 Mirror for i Privilege Escalation
IBM disclosed a privilege escalation flaw in Db2 Mirror for i versions 7.4, 7.5 and 7.6, rated critical with a CVSS 3.1 base score of 9.9. The issue requires an authenticated attacker and could lead to elevated privileges on the affected system. No confirmed exploitation appears in the sources consulted, and the record lists no fixed versions, so administrators should check the vendor advisory.
Overview
IBM published CVE-2026-96012 for Db2 Mirror for i 7.4, 7.5 and 7.6. The record classifies the flaw as CWE-264 (permissions, privileges and access controls) and describes privilege escalation by an authenticated user. The IBM support page is the vendor reference tagged for patch information.
Impact
The NVD record rates the issue critical with a CVSS 3.1 base score of 9.9. The vector indicates network attack, low attack complexity, low privileges required, no user interaction, scope change, and high impact to confidentiality, integrity and availability. In practical terms, a user with a valid account could potentially gain elevated privileges on the system. This is an analytical reading of the vector, not a tested outcome.
Affected products and versions
- IBM Db2 Mirror for i version 7.4
- IBM Db2 Mirror for i version 7.5
- IBM Db2 Mirror for i version 7.6
The record does not list fixed versions. Their absence does not mean no fix exists, so consult the vendor advisory for remediation levels.
Exploitation status
The record shows this CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. The SSVC fields report exploitation as none and automatable as no. The EPSS probability is 0.00509 with percentile 0.41796 as of 2026-10-13. This is a statistical estimate of exploitation likelihood, not evidence of attacks.
Remediation and mitigation
- Review the IBM advisory and plan to apply the vendor corrections that match your Db2 Mirror for i release.
- Until a fix is applied, limit which accounts hold valid credentials on systems running Db2 Mirror for i, following least privilege.
- Audit accounts with elevated authority and remove access that is not needed.
- Prioritize systems with large internal user populations given the critical rating.
Detection guidance
- Monitor authentication and authorization events for unusual privilege changes or access to restricted objects.
- Review logs for unexpected elevation of user profiles or newly granted administrative authority.
- Compare database mirror activity with normal baselines to flag anomalies.
Limitations of the available information
The record has no fixed version details. The vendor advisory content was not reviewed in this analysis. The record does not state whether the flaw is reachable in default configurations, so that remains unknown.
Frequently asked questions
Which Db2 Mirror for i versions are affected?
The record lists IBM Db2 Mirror for i versions 7.4, 7.5 and 7.6. Check the vendor advisory to confirm the exact scope for your release.
Is this vulnerability being actively exploited?
The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. Monitoring should continue as new information emerges.
Does the record include a fixed version?
No. The record does not list fixed versions, but a vendor reference tagged for patch information is included. Consult that advisory for remediation details.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.