IBM Db2 Mirror for i privilege escalation lets authenticated attackers gain system privileges (CVE-2026-96012)

What happened

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 contain a privilege escalation vulnerability. An attacker who already has low-privilege authenticated access can craft a malicious request that bypasses additional authorization and input validation checks. Successful exploitation lets the attacker execute malicious code and obtain elevated privileges on the system.

The CVSS 3.1 score is 9.9, with a vector reflecting low attack complexity, low privileges required, no user interaction, and changed scope. This means a limited account can lead to high impact across confidentiality, integrity, and availability. The CVE record does not report exploitation in the wild.

Who is affected

Affected versions are IBM Db2 Mirror for i 7.4, 7.5, and 7.6. A fix is available, but no fixed version numbers are listed in the CVE record. Organisations running these releases should determine whether Db2 Mirror for i is present and prioritise remediation.

What to do now

1. Apply IBM's fix for CVE-2026-96012. A fix is available, but no fixed version numbers are listed in the CVE record. Use the IBM support page linked in the references to confirm the correct update for your Db2 Mirror for i release.
2. Review and reduce accounts that have access to Db2 Mirror for i. The attack requires authenticated low-privilege access, so removing unnecessary accounts shrinks the exploitable population.
3. Restrict network access to Db2 Mirror for i interfaces, especially from untrusted networks. The vulnerability is reachable over the network with low privileges, so reducing exposure reduces risk.
4. Until patching is complete, monitor for unexpected privileged or administrative actions by low-privilege or service accounts.

How to detect it

The CVE record does not publish indicators of compromise. As practical monitoring, review logs for low-privilege or service accounts performing administrative actions or making unexpected changes in Db2 Mirror for i configuration and data.

Beyond the patch

Privilege escalation like this turns a minor account compromise into a system-wide event. Once IBM's fix is applied, the work is not finished: privilege abuse and malicious code execution leave traces that Managed Detection & Response (MDR) is built to catch, and the delay between IBM's advisory and your patch is a supply-chain exposure problem. Supply Chain Defense & Third-Party Risk helps you track where Db2 Mirror for i and similar vendor products sit in your estate and how quickly remediation reaches them.