What is the CVSS score of EUVD-2026-57378?

EUVD-2026-57378 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of IBM i are affected by EUVD-2026-57378?

IBM i systems running versions 7.5 and 7.6 contain a critical remote command injection vulnerability that allows any low-privilege network user with valid credentials to execute arbitrary commands…. A patch is available.

How to fix or mitigate EUVD-2026-57378?

Within 24 hours, identify and catalog all IBM i 7.5 and 7.6 systems in the environment; implement network-level access restrictions to limit connections to these systems to only authorized administrative networks and hosts. Within 7 days, obtain the vendor-released patch from IBM for IBM i 7.5 and 7.6 and conduct testing in a non-production environment to verify application compatibility. Within 30 days, deploy the patch to all production IBM i 7.5 and 7.6 systems, starting with internet-facing or high-value systems; verify remediation by confirming patched version levels across all endpoints.

IBM i EUVD-2026-57378

| CVE-2026-16906 HIGH

OS Command Injection (CWE-78)

2026-08-12 ibm

GHSA-fm4w-xpvq-9p4j

Command Injection IBM

8.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-accessible OS command injection requiring low-privilege authentication with privilege escalation to elevated execution yields full C:H/I:H/A:H; AC:L confirmed by absence of special conditions in description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 18:42 vuln.today

CVE Published

Aug 12, 2026 - 17:29 nvd

HIGH 8.8

DescriptionCVE.org

IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitrary commands with elevated privileges due to improper neutralization of special elements used in an OS command.

AnalysisAI

Remote OS command injection in IBM i 7.5 and 7.6 enables authenticated attackers with low-privilege network access to execute arbitrary commands with elevated system privileges, resulting in complete compromise of confidentiality, integrity, and availability. The flaw (CWE-78) arises from improper neutralization of special characters passed to OS command processing functions without adequate sanitization. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity and network-accessible attack surface make this a high-priority remediation target for any IBM i deployment.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is IBM's proprietary operating system for Power Systems hardware, widely deployed in banking, manufacturing, and retail as a mission-critical transaction platform. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command - OS Command Injection), where user-supplied input containing shell metacharacters or command separators is passed to a system command execution function without sufficient filtering or escaping. The CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* identifies the IBM i platform broadly; vendor-confirmed affected versions are 7.5 and 7.6. The privilege escalation element - whereby injected commands execute at privileges exceeding those of the authenticated caller - materially amplifies impact beyond a standard authenticated command injection, as a low-privilege user effectively achieves elevated OS-level access.

RemediationAI

Apply the vendor-released patch per IBM Security Advisory at https://www.ibm.com/support/pages/node/7283284. IBM has confirmed a patch is available, though the specific PTF (Program Temporary Fix) identifier or Technology Refresh level is not enumerated in the available reference data - administrators must consult the advisory directly to obtain the correct fix for their IBM i 7.5 or 7.6 release. Until patching is complete, restrict network access to IBM i interfaces and management services to trusted source IP ranges using network-layer controls, noting that this reduces but does not eliminate risk from internal or already-connected threat actors. Audit and minimize the set of user profiles and service accounts holding IBM i access, removing unnecessary credentials to reduce the authenticated attacker surface. Enable and review IBM i system journal (QAUDJRN) entries for anomalous OS command execution events as a detection compensating control.