Advisory · CVE-2026-96012
IBM Db2 Mirror for i authenticated privilege escalation
An authenticated attacker can send a crafted request to IBM Db2 Mirror for i 7.4, 7.5, or 7.6 that bypasses authorization and input validation checks, executes malicious code, and gains elevated privileges.
- Vendor
- IBM
- Product
- Db2 Mirror for i
- Identifier / CWE
- CVE-2026-96012
CWE-264 - Action timing
- Immediate
Explain it like I’m five
A staff badge is supposed to open only your own office. A specially worded request at the front desk is never properly checked, so a low-level badge holder ends up with the master keys.
- 01Authenticated request
An attacker with a valid low-privilege account sends a crafted request to Db2 Mirror for i.
- 02Checks bypassed
The request bypasses additional authorization and input validation checks that should have stopped it.
- 03Code executes
The malicious request executes code on the system instead of being rejected.
- 04Privileges gained
The attacker obtains elevated privileges on the affected system.
What happened
IBM disclosed CVE-2026-96012 on October 12, 2026, for Db2 Mirror for i versions 7.4, 7.5, and 7.6, and rates it CVSS 3.1 9.9 with a changed scope.
Per IBM, an authenticated attacker can craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker who exploits this can obtain elevated privileges on the system.
The IBM bulletin linked above is the source for affected versions and remediation. The NVD record does not name a specific fixed level, so this advisory does not claim one.
What to do
- Inventory IBM i systems running Db2 Mirror for i 7.4, 7.5, or 7.6.
- Apply the remediation in the IBM bulletin for your release.
- Restrict which accounts can reach Db2 Mirror services until remediation is complete.
- Review account activity and audit logs for unusual requests from low-privilege accounts.
- Confirm no new privileged accounts or objects appeared around any suspicious activity.
- Verify the deployed fix level after remediation.
Management note
The attacker needs an account, but the payoff is full elevation on a system that typically sits next to core business data. Low-privilege and service accounts on IBM i deserve the same suspicion here as internet-facing flaws get elsewhere.