IBM Db2 Mirror for i versions 7.4 through 7.6 contain a privilege‑escalation flaw. An attacker who is already authenticated can craft a malicious request that bypasses the subsystem’s additional authorization and input‑validation checks, allowing the attacker to execute arbitrary code with elevated rights. The flaw enables an attacker to gain higher privileges on the affected system.

Stakeholders are impacted if they run IBM Db2 Mirror for i 7.4, 7.5, or 7.6 on an IBM i platform. The affected releases are specified by PTF numbers SJ11623 for 7.4, SJ11624 for 7.5, and SJ11625 for 7.6, all distributed through IBM Fix Central or the links provided in the IBM advisory. These versions run on IBM i Release 7.x environments.

With a CVSS score of 9.9 the vulnerability is considered Critical. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no known public exploit yet. However, the flaw requires an authenticated session, and once credentials exist an attacker can leverage the flaw to gain higher privileges. Organizations with exposed or unused user accounts should prioritize applying the security technical alert before the vulnerability can be abused.