CVE-2026-18104: IBM Db2 Mirror Information Disclosure Flaw

CVE-2026-18104 Overview

IBM Db2 Mirror for i contains a cryptographic weakness that allows a local attacker to obtain sensitive information. The product uses the Advanced Encryption Standard (AES) in Electronic Codebook (ECB) mode, which does not provide semantic security. Identical plaintext blocks produce identical ciphertext blocks, leaking data patterns to anyone able to read ciphertext locally.

The flaw affects IBM Db2 Mirror for i versions 7.6, 7.5, and 7.4. The weakness maps to [CWE-327: Use of a Broken or Risky Cryptographic Algorithm]. Exploitation requires local access and low privileges with no user interaction.

Critical Impact
A local authenticated attacker can analyze ECB-encrypted data to infer sensitive information handled by Db2 Mirror for i.

Affected Products

IBM Db2 Mirror for i 7.4
IBM Db2 Mirror for i 7.5
IBM Db2 Mirror for i 7.6

Discovery Timeline

2026-09-24 - CVE-2026-18104 published to the National Vulnerability Database (NVD)
2026-09-29 - Last updated in the NVD database

Technical Details for CVE-2026-18104

Vulnerability Analysis

IBM Db2 Mirror for i encrypts sensitive data using AES in Electronic Codebook (ECB) mode. ECB encrypts each 16-byte block independently with the same key. This deterministic property causes identical plaintext blocks to produce identical ciphertext blocks.

An attacker who can read ciphertext locally can detect repeated structures, infer plaintext patterns, and correlate encrypted records. Structured data such as fixed-format records, headers, or repeated field values is particularly exposed. The confidentiality impact is limited to information disclosure. There is no integrity or availability impact.

Root Cause

The root cause is the selection of ECB as the block cipher mode of operation. ECB does not use an initialization vector (IV) and does not chain blocks. Modern cryptographic guidance favors authenticated modes such as AES-GCM or AES-CCM, or at minimum CBC with a random IV. The use of ECB in Db2 Mirror for i violates these guidelines and falls under [CWE-327].

Attack Vector

Exploitation requires local access to the IBM i system and low-privilege credentials. No user interaction is needed. The attacker reads ECB-encrypted ciphertext accessible under their privilege level, then performs frequency and pattern analysis on repeating blocks to recover information about the underlying plaintext.

No public proof-of-concept exploit is available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and the EPSS probability is 0.06%. See the IBM Support Page for Node 7289246 for vendor technical details.

Detection Methods for CVE-2026-18104

Indicators of Compromise

No public indicators of compromise are associated with CVE-2026-18104 at this time.
Unusual read access by low-privileged users to Db2 Mirror for i data files or encrypted artifacts.
Repeated access patterns against encrypted database objects that may indicate ciphertext harvesting.

Detection Strategies

Audit file and object access on IBM i systems hosting Db2 Mirror, focusing on local users enumerating encrypted stores.
Review installed Db2 Mirror for i versions against vendor advisories to identify unpatched hosts.
Correlate IBM i audit journal (QAUDJRN) entries for object access with user privilege context to spot anomalous local activity.

Monitoring Recommendations

Enable and ship IBM i security audit journal entries to a central analytics platform for retention and correlation.
Monitor for new local accounts or privilege changes on systems running Db2 Mirror for i.
Track vendor security bulletins for IBM Db2 Mirror for i to confirm patch deployment status across the fleet.

How to Mitigate CVE-2026-18104

Immediate Actions Required

Apply the IBM-provided fix for Db2 Mirror for i 7.4, 7.5, and 7.6 as documented in the vendor advisory.
Inventory all IBM i hosts running Db2 Mirror and prioritize patching systems that store or process sensitive data.
Restrict local account access on affected systems to reduce the pool of users who meet the exploitation prerequisites.

Patch Information

IBM has published remediation guidance on the IBM Support Page for Node 7289246. Administrators should follow the version-specific instructions for Db2 Mirror for i 7.4, 7.5, and 7.6 to replace ECB-mode encryption with a vendor-approved configuration.

Workarounds

Limit local shell and interactive access on IBM i systems hosting Db2 Mirror to a minimal set of administrative users.
Apply least-privilege object authority on Db2 Mirror data objects so standard users cannot read encrypted stores.
Where feasible, isolate Db2 Mirror hosts on segmented networks and enforce strict logon controls until patches are deployed.

bash

# Example: review object authority on IBM i to limit local read access
DSPOBJAUT OBJ(QSYS/DB2MIRROR) OBJTYPE(*LIB)
RVKOBJAUT OBJ(QSYS/DB2MIRROR) OBJTYPE(*LIB) USER(*PUBLIC) AUT(*ALL)
GRTOBJAUT OBJ(QSYS/DB2MIRROR) OBJTYPE(*LIB) USER(DBADMIN) AUT(*USE)