IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 contain a vulnerability classified as CWE-73 (External Control of File Name or Path). This flaw allows a remote attacker to control file names or paths used by the application, leading to arbitrary code execution. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official remediation or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation could result in remote arbitrary code execution, compromising confidentiality, integrity, and availability of the affected system. The attacker requires no privileges or user interaction, making this a highly severe risk for affected installations.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is released, monitor IBM security advisories closely for updates. No temporary or official fixes are currently documented.