Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-12T20:17:40.550Z",
  "pubdate": "2026-08-12T20:17:40.550Z",
  "executiveSummary": "This vulnerability involves an improper neutralization of special elements used in an operating system command, leading to OS command injection flaws within IBM i.\nThe vulnerability allows a remote authenticated attacker to execute arbitrary commands on the underlying operating system.\nAffected products include IBM i versions 7.6, 7.5, 7.4, and 7.3.\nThe risk implications are severe, as successful exploitation permits unauthorized execution of system-level instructions, potentially compromising the confidentiality, integrity, and availability of the affected system.\nThe attacker capabilities require prior authentication to the target system.\nExploitation requirements dictate that the malicious actor must supply specially crafted input containing special elements designed to break out of the intended command structure and execute arbitrary OS-level payloads.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation and improper sanitization of special elements used in an OS command within the vulnerable component of IBM i.\nWhen user-supplied input containing command delimiters or shell metacharacters is processed by the application without adequate neutralization, the underlying operating system interprets these characters as instructions rather than literal data.\nThe attack vector is network-exposed, requiring the attacker to possess remote authentication credentials to interact with the vulnerable interface.\nThe attack flow begins when an authenticated attacker submits a maliciously crafted payload containing OS command injection sequences to the vulnerable application endpoint.\nThe vulnerable component fails to properly filter or escape special characters, passing the tainted string directly to the underlying OS command processor or shell interface.\nConsequently, the operating system executes the attacker-supplied payload alongside or instead of the intended administrative or operational command.\nThe payload behavior allows the execution of arbitrary system commands with the privileges associated with the vulnerable process or the authenticated user session.\nThe post-exploitation impact includes full system compromise, unauthorized data access, system manipulation, lateral movement within the network, and potential disruption of critical business services running on the IBM i instance.\nAffected versions are explicitly restricted to IBM i 7.6, 7.5, 7.4, and 7.3."
}