CVE-2026-16660: IBM Db2 Mirror for i DOS Vulnerability

CVE-2026-16660 Overview

CVE-2026-16660 is an out-of-bounds read vulnerability [CWE-125] affecting IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. A remote attacker can trigger the flaw over the network without authentication or user interaction. Successful exploitation results in a denial of service condition against the affected Db2 Mirror service. The vulnerability affects only availability. Confidentiality and integrity are not impacted based on the published CVSS vector.

Critical Impact
Unauthenticated remote attackers can crash or disrupt IBM Db2 Mirror for i services, interrupting high-availability database replication between IBM i nodes.

Affected Products

IBM Db2 Mirror for i 7.4
IBM Db2 Mirror for i 7.5
IBM Db2 Mirror for i 7.6

Discovery Timeline

2026-09-04 - CVE-2026-16660 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-16660

Vulnerability Analysis

The flaw is an out-of-bounds read in IBM Db2 Mirror for i. Db2 Mirror provides continuous availability through synchronous replication between two IBM i nodes. A remote attacker can send crafted network input that causes the service to read memory beyond an allocated buffer boundary. The resulting fault terminates or destabilizes the Db2 Mirror process, producing a denial of service. Because the read occurs outside intended bounds, execution reaches an invalid state and the process cannot continue safely.

The attack requires no privileges and no user interaction. The scope remains unchanged, meaning the impact is limited to the vulnerable component itself. Only the availability metric is affected in the CVSS vector, and no code execution or data disclosure has been documented by IBM.

Root Cause

The root cause is missing or insufficient bounds validation on attacker-controlled input processed by the Db2 Mirror service. When the affected code path parses network-supplied data, it reads past the end of an allocated buffer. IBM has not published the specific function or protocol field involved. See the IBM Support Page for vendor-provided technical context.

Attack Vector

Exploitation occurs over the network against a Db2 Mirror for i listener. The attacker sends a specially crafted request that reaches the vulnerable parsing routine. Neither valid credentials nor user interaction is required. No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.357%.

Detection Methods for CVE-2026-16660

Indicators of Compromise

Unexpected termination or repeated restarts of Db2 Mirror services on IBM i nodes running 7.4, 7.5, or 7.6.
Replication interruptions or synchronization failures between paired Db2 Mirror nodes without a corresponding operational change.
Job logs on IBM i showing abnormal end conditions in Db2 Mirror server jobs following inbound network activity.

Detection Strategies

Monitor Db2 Mirror service health and replication state for anomalous drops that correlate with external network connections.
Correlate IBM i system operator messages (QSYSOPR) and job logs with network flow data targeting Db2 Mirror listener ports.
Alert on repeated crash-and-restart cycles of Db2 Mirror server jobs, which can indicate exploitation attempts.

Monitoring Recommendations

Ingest IBM i audit journal (QAUDJRN) and Db2 Mirror service logs into a centralized SIEM for continuous analysis.
Track inbound connections to Db2 Mirror ports from unexpected sources and baseline normal peer-to-peer replication traffic.
Establish alerts on service availability metrics and mean time between Db2 Mirror job restarts.

How to Mitigate CVE-2026-16660

Immediate Actions Required

Review the IBM Support Page and apply the vendor-supplied PTF for your Db2 Mirror for i release (7.4, 7.5, or 7.6).
Inventory all IBM i systems running Db2 Mirror and confirm current release and PTF levels.
Restrict network access to Db2 Mirror listener ports so only paired mirror nodes can reach them.

Patch Information

IBM has published remediation guidance and Program Temporary Fixes (PTFs) for Db2 Mirror for i 7.4, 7.5, and 7.6. Refer to the IBM Support Page for the exact PTF identifiers and installation instructions for each supported release. Apply the fixes during a scheduled maintenance window and validate replication state after installation.

Workarounds

Enforce network segmentation and firewall rules that permit Db2 Mirror traffic only between authorized mirror partner nodes.
Place Db2 Mirror interfaces on a dedicated replication network isolated from general user and internet-facing traffic.
Increase monitoring of Db2 Mirror service availability until PTFs are deployed so that any exploitation attempt is detected quickly.

bash

# Configuration example
# Refer to the IBM Support Page for the authoritative PTF identifiers
# for IBM Db2 Mirror for i 7.4, 7.5, and 7.6:
# https://www.ibm.com/support/pages/node/7285904