EUVD-2026-71485
GHSA-q38c-6cwh-cgcx
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with low-privilege account required; once metacharacters are injected into an OS command call, full system compromise across all three impact pillars is achievable.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
AnalysisAI
OS command injection in IBM i 7.3 through 7.6 allows a local, low-privileged attacker to execute arbitrary operating system commands by supplying specially crafted input containing shell metacharacters that the platform fails to sanitize before passing to an OS command interpreter. The vulnerability (CWE-78) affects IBM's flagship Power Systems operating system across four supported release lines and carries a CVSS 7.8 score reflecting full confidentiality, integrity, and availability impact upon successful exploitation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid local account on the affected IBM i system with sufficient authority to invoke the vulnerable component (PR:L per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 score is partially offset by the strictly local attack vector (AV:L), which prevents direct remote exploitation without a prior foothold. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch is available per IBM's support advisory at https://www.ibm.com/support/pages/node/7285844; administrators should consult that page directly to identify the applicable PTF (Program Temporary Fix) or cumulative fix package for their specific IBM i release (7.3, 7.4, 7.5, or 7.6) and apply it during the next maintenance window. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running IBM i versions 7.3 through 7.6 and document local user access patterns as baseline risk assessment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today