OS command injection in IBM Db2 Mirror for i (CVE-2026-16956)

IBM Db2 Mirror for i contains an OS command injection vulnerability (CWE-78) caused by improper neutralization of special elements in OS commands. A remote, unauthenticated attacker can exploit this flaw to execute arbitrary commands on the affected system, with potential for full compromise of confidentiality, integrity, and availability. Affected versions: - 7.4 - 7.5 - 7.6 We recommend updating to: 7.4 PTF SJ10957, 7.5 PTF SJ10954. CVSS 9.8 · our assessment: act_now Reference: https://www.ibm.com/support/pages/node/7283281 Details: https://vuln.today/cve/CVE-2026-16956