Loading story…
Researchers disclosed a pre-authentication exploit chain in the IBM Db2 Mirror for i GUI WAR running on an IBM i Liberty administrative server. A semicolon path parameter can cause AuthFilter to miss the Db2MirrorServlet route, bypassing session authentication and other checks; an unauthenticated session parameter can then disable request validation. The exposed LogAction.getLogFileContent function enables arbitrary file reads, while attacker-controlled IBM Toolbox trace-file settings provide a write primitive capable of creating a JSP in the expanded WAR directory.
The malicious JSP executes in the Liberty JVM, giving an unauthenticated attacker server-side Java execution. In a tested IBM i V7R5 environment, researchers used the QLWIUTIL3-backed NativeMethods.doMethod helper to make a local Db2 connection identify as QSECOFR, IBM i's highest-privilege authority, potentially converting the remote compromise into full system-level control. The available reporting does not identify a CVE, affected-version range, patch, or confirmed exploitation in the wild.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A write-up disclosed an authentication-bypass and validation-bypass chain in the IBM Db2 Mirror for i GUI that enables unauthenticated file reads and can create and execute a JSP in the Liberty server context. In a tested IBM i V7R5 environment, the resulting Java execution could invoke a native helper that caused a local Db2 connection to run as QSECOFR, potentially escalating to highest-authority access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
IBM disclosed **CVE-2026-10109**, a critical remote code execution flaw in **IBM Db2** caused by improper handling of the pre-authentication **DRDA handshake**. The vulnerability is tracked as **CWE-94** and carries a **CVSS 3.1 score of 9.8**, indicating that attackers can exploit it remotely over the network without privileges or user interaction. The issue affects **IBM Db2 Server** versions **11.5.0 through 11.5.9** and **12.1.0 through 12.1.4** across all platforms. IBM said there is **no workaround or mitigation** and directed customers to obtain interim special builds and the latest security fixes through **Fix Central** to remediate exposed systems.
Jun 30, 2026
IBM disclosed **CVE-2026-10543**, a high-severity privilege-escalation vulnerability in **IBM Db2** that can be triggered with a specially crafted query. The flaw is classified as **CWE-285 Improper Authorization** and carries a **CVSS v3.1 score of 8.2** with vector `AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N`, indicating low-complexity, network-exploitable abuse with no user interaction required and a high integrity impact. The issue affects **IBM Db2 Server** versions **11.5.0 through 11.5.9** and **12.1.0 through 12.1.5** on all platforms. IBM said interim security updates are available through **Fix Central** for supported release levels, while noting that **no workarounds or mitigations** are available. The company withheld detailed exploitation guidance to reduce attacker enablement and credited **Nicolas Verdier of Amazon** with reporting the vulnerability.
Aug 13, 2026
IBM disclosed multiple vulnerabilities in **WebSphere Application Server** and **WebSphere Application Server Liberty**, including denial-of-service issues tracked as `CVE-2026-9071` and `CVE-2026-9320`, and an HTTP request smuggling flaw, `CVE-2026-8646`, rated up to **CVSS 8.1**. The affected products include WebSphere Application Server **8.5** and **9.0**, along with WebSphere Liberty versions **17.0.0.3 through 26.0.0.6** when certain servlet or websocket features are enabled. IBM said no workarounds or mitigations are available and advised customers to apply interim fixes for **APAR PH71631** and **PH71370** or upgrade to fix packs **26.0.0.7**, **9.0.5.29**, or **8.5.5.30**. A related high-severity issue, `CVE-2026-9072`, affects **IBM i 7.3 through 7.6** in environments using WebSphere Application Server or Liberty with **Intelligent Management** and the **WebSphere WebServer Plug-in**. IBM said an attacker who can impersonate backend servers and send crafted responses to the plug-in could trigger **remote code execution** and **denial of service**, also with a **CVSS 8.1** rating. Recommended actions include installing the latest WebSphere security updates, updating IBM i to current levels, and reviewing the secure configuration of Intelligent Management and the WebSphere WebServer Plug-in.
Jun 29, 2026