IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 contain a vulnerability classified as CWE-73 (External Control of File Name or Path). This flaw allows a remote attacker to control file names or paths used by the software, potentially leading to arbitrary code execution. The vulnerability is remotely exploitable without requiring privileges or user interaction, resulting in a critical impact on system confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.8, reflecting the severity of this issue. As of the published date, no official remediation or patch has been disclosed by IBM.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system. This compromises confidentiality, integrity, and availability of the IBM Db2 Mirror for i environment. Given the remote, no-privilege, no-user-interaction nature of the vulnerability, it poses a significant risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor IBM's security advisories for updates. No specific mitigations have been provided by the vendor at this time.