IBM week 39 of 2026: one low-severity encryption flaw in Db2 Mirror for i

The release at a glance

IBM's security release for week 39 of 2026, covering 21 September to 27 September, contains one CVE in scope for readers: CVE-2026-18104. It affects IBM Db2 Mirror for i versions 7.6, 7.5 and 7.4. The vulnerability is rated low severity under CVSS v3.1 with a score of 3.3 and a local attack vector. IBM published the associated advisory on 24 September 2026.

The single finding is the use of AES Electronic Codebook (ECB) mode for encryption, recorded as CWE-327, which can allow a local attacker to obtain sensitive information. The vulnerability is not marked exploited and does not appear in CISA's Known Exploited Vulnerabilities catalog. The SSVC assessment for this CVE reports exploitation none, automatable no and technical impact partial. In short, this release is one product, one CVE and one low-severity finding.

What matters most

The only CVE to review is CVE-2026-18104, affecting IBM Db2 Mirror for i 7.6, 7.5 and 7.4. The issue is a cryptographic weakness: the product uses AES ECB mode for encryption. ECB mode does not chain blocks, so identical plaintext blocks produce identical ciphertext blocks, which can reveal patterns in encrypted data. A local attacker with low privileges who can access the encrypted data may be able to obtain sensitive information. The CVSS v3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, meaning the attack requires local access and low privileges, no user interaction is needed, and the impact is limited to confidentiality.

IBM's advisory indicates a fix is available, but the release summary does not list specific fixed version numbers. EPSS gives this CVE a probability of 0.1 percent with a percentile of 0. The issue ranks first simply because it is the only CVE in scope; there is no active exploitation, no CISA KEV entry and no vendor statement of exploitation.

Patch in this order

1. Identify IBM Db2 Mirror for i installations running versions 7.6, 7.5 or 7.4, including standby, test and disaster-recovery nodes that may be part of mirroring topologies.
2. Review IBM's advisory and confirm the remediated build or fix for the version you run, because the release summary does not state fixed version numbers.
3. Treat this as a standard change. The CVE has a low CVSS score, a local attack vector, no CISA KEV entry and no exploitation flags, so normal patch scheduling is appropriate rather than an emergency change.
4. Until patching is complete, continue to enforce existing local access controls and restrict low-privileged accounts with access to Db2 Mirror for i, since the attack vector requires a local low-privileged attacker.
5. Record the affected product and versions in your software inventory so that future IBM advisories can be matched to your estate. This is also a useful data point for supplier patch-cycle tracking.

Beyond the patch

A one-CVE low-severity release can easily be deferred or lost in the patch queue, but the real management task is knowing which IBM products are in your estate, which versions run where, and how quickly the supplier fixes them. That is supplier patch-cycle risk. Our Supply Chain Defense & Third-Party Risk service maps that exposure window across vendors. If you are aligning this to NIS2 or DORA, see the frameworks page, and you can book a meeting to discuss your patch cadence.