Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-12T20:17:40.170Z",
  "pubdate": "2026-08-12T20:17:40.170Z",
  "executiveSummary": "A remote command injection vulnerability has been identified in IBM i versions 7.6, 7.5, 7.4, and 7.3.\nThe vulnerability arises due to the improper neutralization of shell metacharacters within the application logic, allowing a remote authenticated attacker to execute arbitrary system commands.\nSuccessful exploitation of this flaw can compromise the confidentiality, integrity, and availability of the underlying operating system.\nThe attack requires remote authentication and leverages inadequate input sanitization where user-supplied data is passed to a system shell.\nRisk implications include full system compromise, unauthorized execution of administrative utilities, and potential escalation of privileges within the affected environment.",
  "technicalDetails": "The root cause of the vulnerability is insufficient input validation and improper sanitization of shell metacharacters in affected components of IBM i 7.6, 7.5, 7.4, and 7.3.\nWhen a remote authenticated user supplies specially crafted input containing shell metacharacters, the application fails to neutralize these characters before passing the payload to the underlying command interpreter.\nThis behavior results in command injection, enabling the attacker to chain arbitrary shell commands together with legitimate execution flows.\nThe attack flow begins with the authenticated adversary submitting a malicious payload via the vulnerable interface exposed over the network.\nUpon receiving the input, the vulnerable component constructs a system command string without properly escaping or filtering special characters such as semicolons, ampersands, or pipe symbols.\nThe operating system executes the resulting command string with the privileges associated with the application context, leading to arbitrary command execution.\nExploitation requirements mandate that the attacker possesses valid authentication credentials to access the vulnerable functionality.\nPost-exploitation impact includes unauthorized data access, execution of arbitrary binaries, manipulation of system configurations, and potential lateral movement across the network."
}