IBM Db2 Mirror for i privilege escalation lets authenticated attackers gain elevated privileges (CVE-2026-96012)

What happened

IBM Db2 Mirror for i 7.4, 7.5 and 7.6 is vulnerable to privilege escalation. An authenticated attacker can craft a malicious request that bypasses additional authorization and input validation checks. The result is the ability to execute malicious code and obtain elevated privileges on the system.

The CVSS 3.1 score is 9.9 (critical). The attack vector is network-based, requires low privileges and no user interaction, and has changed scope with high impacts to confidentiality, integrity and availability.

The CVE record does not list exploitation or public disclosure, and the flaw is not listed in CISA's KEV catalogue.

Who is affected

IBM lists Db2 Mirror for i 7.4, 7.5 and 7.6 as affected. Organisations running these releases should assume they are affected until they confirm the fixed level. If you are not sure which release is in use, check the product version on each IBM i partition that has Db2 Mirror for i installed.

What to do now

1. Confirm whether Db2 Mirror for i 7.4, 7.5 or 7.6 is present in your environment.
2. Apply IBM's fix. IBM indicates a fix is available; the linked IBM support page has the vendor's update information. The CVE record does not list fixed release numbers, so refer to that page for the correct update for your environment.
3. Until patching is complete, restrict network access to Db2 Mirror for i services and review accounts that can reach them. Remove or limit shared and high-privilege accounts where practical.
4. After patching, review security audit records for any new high-privilege profiles or unexpected authority assignments.

How to detect it

The CVE record does not list specific indicators of compromise for this vulnerability. In the meantime, monitor IBM i security audit records for unexpected changes to user profiles, newly granted special authorities, or Db2 Mirror for i jobs running under elevated accounts. These checks support containment; they do not replace patching.

Beyond the patch

This is a privilege escalation reachable with only a low-privileged account, so the risk is not limited to internet-facing systems. As you patch, put detection around the abuse of newly elevated accounts. Managed Detection & Response is built for spotting the post-exploitation activity that follows privilege escalation, and Supply Chain Defense & Third-Party Risk helps track which IBM releases you run and how quickly fixes arrive.