CVE-2026-18104
Awaiting Analysis Awaiting Analysis - Queue

IBM Db2 Mirror for i Weak Encryption Information Disclosure

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: IBM Corporation

Description
IBM Db2 Mirror for i 7.6, 7.5, and 7.4 could allow a local attacker to obtain sensitive information due to the use of the AES Electronic Codebook (ECB) mode for encryption.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-18104
EUVD
EUVD-2026-85892

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
ibm db2_mirror_for_i to 7.4 (inc)
ibm db2_mirror_for_i to 7.5 (inc)
ibm db2_mirror_for_i to 7.6 (inc)
ibm db2_mirror_for_i 7.4
ibm db2_mirror_for_i 7.5
ibm db2_mirror_for_i 7.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-327 The product uses a broken or risky cryptographic algorithm or protocol.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 use AES in ECB mode for encryption, which is considered insecure. This allows a local attacker to decrypt sensitive information due to ECB's predictable pattern in encrypting identical plaintext blocks.

Detection Guidance

Detection involves checking for the use of AES-ECB mode in IBM Db2 Mirror for i configurations. Review encryption settings in the system's cryptographic configuration files or administrative interfaces. Compare installed versions against affected releases (7.4, 7.5, 7.6) and verify if PTF fixes (SJ11539, SJ11538, SJ11540) are applied.

Impact Analysis

A local attacker could exploit this flaw to access sensitive data stored or transmitted by the affected IBM Db2 Mirror for i versions. The impact is limited to confidentiality breaches as integrity and availability are not affected.

Compliance Impact

Using ECB mode violates encryption best practices and may lead to non-compliance with GDPR (data protection) and HIPAA (health data security) due to inadequate safeguards for sensitive information.

Mitigation Strategies

Apply the relevant PTF fixes provided by IBM: SJ11539 for version 7.6, SJ11538 for version 7.5, and SJ11540 for version 7.4. No other workarounds or mitigations are currently available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18104. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart