EUVD-2026-71467
GHSA-6xhg-2hv5-8h8x
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local account required (AV:L, PR:L); simple metacharacter injection (AC:L); unrestricted command execution yields full CIA impact with no scope change.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
AnalysisAI
Local OS command injection in IBM i 7.3 through 7.6 allows a low-privileged local user to execute arbitrary system commands, achieving full system compromise (confidentiality, integrity, and availability all at High). The vulnerability stems from insufficient neutralization of shell metacharacters in OS command construction (CWE-78). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must possess a valid local account on the IBM i system with at least low-level interactive access (PR:L per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures a local, low-privilege, low-complexity attack yielding full CIA impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch documented in IBM support page node/7285844 (https://www.ibm.com/support/pages/node/7285844) for all affected IBM i versions 7.3, 7.4, 7.5, and 7.6; exact PTF identifiers are available at that URL. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all IBM i 7.3-7.6 systems in your environment and identify which ones permit local user access from non-administrative accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today