IBM i versions 7.3 through 7.6 contain an uncontrolled search path element vulnerability (CWE-427) that can be exploited by a remote attacker with authentication to execute arbitrary code. The vulnerability arises from improper handling of search paths, which may allow malicious code to be loaded and executed. The CVSS 3.1 base score is 9.9, indicating critical severity, with attack vector network, low attack complexity, requiring privileges, no user interaction, and resulting in complete system compromise.

Successful exploitation allows remote authenticated attackers to execute arbitrary code, potentially leading to full system compromise including confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. No official fix or temporary mitigation has been publicly disclosed at this time.