EUVD-2026-62733
GHSA-h878-5fmm-j2cm
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent vector confirmed by AV:A; PR:N because no authentication is required; full C/I/A impact reflects arbitrary OS command execution capability.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
AnalysisAI
OS command injection in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables an unauthenticated attacker with adjacent network access to execute arbitrary operating system commands without any user interaction. The flaw (CWE-78) resides in a network-exposed component that fails to neutralize shell metacharacters before incorporating user-supplied input into OS commands, granting full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, but a vendor patch is available via IBM support advisory.
Technical ContextAI
CWE-78 (Improper Neutralization of Special Elements used in an OS Command) describes a class of injection flaw in which software constructs a shell command from external input without adequately sanitizing metacharacters such as semicolons, pipes, backticks, or dollar signs. IBM AIX is a Unix-based operating system running on IBM Power-architecture hardware; IBM PowerVM VIOS (Virtual I/O Server) is the virtualization management layer that sits between AIX logical partitions and physical hardware resources. Both products are affected according to CPE strings cpe:2.3:a:ibm:aix:*:*:*:*:*:*:*:* and cpe:2.3:a:ibm:powervm_vios:*:*:*:*:*:*:*:*. The CVSS adjacent-network vector (AV:A) indicates the vulnerable service is reachable over a local network segment but is not necessarily exposed to the open internet, consistent with the role these products play in enterprise data center environments.
RemediationAI
Apply the vendor-released fix as documented in the IBM support advisory at https://www.ibm.com/support/pages/node/7283858, which provides specific APARs and fix packs for AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1. The exact patched version numbers must be confirmed from that advisory, as version-level detail is not independently available in the current data set. As a compensating control while scheduling maintenance, use layer-2 segmentation, firewall ACLs, or VLAN isolation to restrict which hosts on adjacent network segments can reach the vulnerable service on AIX and VIOS systems - this directly addresses the AV:A attack vector and is the most targeted interim mitigation. Additionally, disabling or firewalling any non-essential network-facing services on VIOS partitions reduces the attack surface without full patching; however, on VIOS, service availability is often tied to I/O functions for hosted LPARs, so assess operational impact before disabling services.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today