CVE-2026-17483: IBM Db2 Mirror for i Privilege Escalation

CVE-2026-17483 Overview

CVE-2026-17483 is an improper access control vulnerability [CWE-285] in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 on IBM i. A local authenticated attacker can delete historical flight-recorder archives through an SQL procedure that fails to enforce required authorization checks. The flaw affects the integrity of diagnostic data used for troubleshooting and audit purposes but does not expose confidential data or disrupt availability of the database service itself.

Critical Impact
A local user with low privileges can delete historical flight-recorder archives, potentially removing forensic and diagnostic evidence needed for incident investigation.

Affected Products

IBM Db2 Mirror for i 7.4
IBM Db2 Mirror for i 7.5
IBM Db2 Mirror for i 7.6

Discovery Timeline

2026-09-04 - CVE-2026-17483 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-17483

Vulnerability Analysis

The vulnerability resides in an SQL procedure within IBM Db2 Mirror for i that manages historical flight-recorder archives. The procedure does not verify that the caller possesses the authority required to delete archive records. As a result, a local user who can authenticate to the IBM i system and invoke the procedure can remove archived diagnostic data.

Flight-recorder archives contain historical operational telemetry used to reconstruct database mirror activity. Removing these archives undermines post-incident analysis and can hinder detection of prior malicious activity. The issue is scoped to integrity impact only; the attacker cannot read protected data or induce a denial-of-service condition through this flaw.

Root Cause

The defect is a missing authorization check [CWE-285] in an SQL procedure exposed by Db2 Mirror for i. The procedure trusts the caller's session context and performs deletion operations on archive objects without validating that the invoking user account has been granted the appropriate object or function authority.

Attack Vector

Exploitation requires local access to the IBM i host and a valid user profile with permission to execute the affected SQL procedure. No user interaction is required. The attacker calls the procedure through any Db2 client interface available on the system, such as an interactive SQL session, and issues the deletion operation against target archive entries. Refer to the IBM Support Page for technical specifics of the affected procedure.

Detection Methods for CVE-2026-17483

Indicators of Compromise

Unexpected deletion of flight-recorder archive records in Db2 Mirror for i.
SQL procedure invocations from user profiles that should not have archive-management responsibilities.
Gaps in historical mirror telemetry that cannot be attributed to scheduled maintenance.

Detection Strategies

Enable and review IBM i audit journal (QAUDJRN) entries for SQL statement execution and object deletion events tied to Db2 Mirror archive objects.
Correlate SQL procedure calls with the invoking user profile to identify calls from unauthorized accounts.
Baseline the normal cadence of archive rotation and alert on out-of-band deletions.

Monitoring Recommendations

Forward IBM i audit journal data to a centralized log platform for retention and analysis.
Monitor privileged and semi-privileged user profiles that can reach the Db2 Mirror interface.
Alert on deletion operations targeting flight-recorder archive libraries or files outside change windows.

How to Mitigate CVE-2026-17483

Immediate Actions Required

Apply the fix referenced in the IBM advisory for Db2 Mirror for i 7.4, 7.5, and 7.6.
Inventory user profiles with authority to invoke Db2 Mirror SQL procedures and remove unnecessary grants.
Preserve current flight-recorder archives to an offline or write-protected location before any remediation work.

Patch Information

IBM has published remediation guidance on the IBM Support Page for CVE-2026-17483. Administrators should apply the referenced PTFs for the affected IBM i releases in accordance with IBM's instructions.

Workarounds

Restrict *USE authority on the affected SQL procedure to administrator profiles until the patch is applied.
Enable object auditing on flight-recorder archive libraries so that any deletion is recorded in QAUDJRN.
Limit interactive and programmatic access to the IBM i partition hosting Db2 Mirror to trusted operators.

bash

# Configuration example
# Revoke public access to the affected procedure and audit deletions
RVKOBJAUT OBJ(QSYS2/AFFECTED_PROC) OBJTYPE(*SQLPKG) USER(*PUBLIC) AUT(*ALL)
CHGOBJAUD OBJ(MIRRORLIB/FLIGHTREC) OBJTYPE(*FILE) OBJAUD(*ALL)