What is the CVSS score of EUVD-2026-57532?

EUVD-2026-57532 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM i are affected by EUVD-2026-57532?

A command injection vulnerability (CVE-2026-17642, CVSS 8.8) in IBM i versions 7.3 through 7.6 allows authenticated attackers to execute arbitrary operating system commands with service-level…. A patch is available.

How to fix or mitigate EUVD-2026-57532?

Within 24 hours, inventory all IBM i systems currently running versions 7.3 through 7.6 and classify by business criticality. Within 7 days, obtain and apply the patch available per vendor advisory from IBM for all affected systems, prioritizing production and business-critical systems first. Within 30 days, verify patch application across your complete IBM i fleet, implement monitoring for command injection exploitation attempts targeting this vulnerability, and document patch compliance status in your vulnerability management system.

IBM i EUVD-2026-57532

| CVE-2026-17642 HIGH

OS Command Injection (CWE-78)

2026-08-12 ibm

GHSA-63jf-9mx6-49rm

Command Injection IBM

8.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable, low-complexity OS command injection requiring only low-privilege authentication; full CIA impact consistent with arbitrary command execution.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 20:26 vuln.today

CVE Published

Aug 12, 2026 - 19:43 nvd

HIGH 8.8

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

AnalysisAI

OS command injection in IBM i 7.3 through 7.6 allows a remote authenticated attacker to execute arbitrary operating system commands with the privileges of the affected service. The vulnerability stems from improper neutralization of special elements in OS commands (CWE-78), covering all four current IBM i release lines. No public exploit or CISA KEV listing has been identified at time of analysis, but the high CVSS score of 8.8 and full CIA impact triad reflect serious post-authentication risk on a platform commonly used for enterprise workloads.

Technical ContextAI

IBM i (formerly AS/400, iSeries) is IBM's integrated operating system for Power Systems hardware, widely used in enterprise and mid-market environments for ERP, financial, and transactional workloads. The affected CPE is cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*, covering all sub-versions of IBM i 7.3, 7.4, 7.5, and 7.6. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates that user-controlled input is passed to a system shell or equivalent command execution interface without adequate sanitization or escaping, allowing injection of additional OS commands. On IBM i, this is particularly consequential because the platform integrates the OS, database (Db2 for i), and application layer, meaning command execution may traverse multiple privilege boundaries.

RemediationAI

Apply the vendor-released patch per IBM's advisory at https://www.ibm.com/support/pages/node/7283275, which provides PTF (Program Temporary Fix) details specific to each affected IBM i release (7.3, 7.4, 7.5, 7.6). IBM i patching requires applying the relevant PTF group or individual PTF via the WRKPTFGRP or GO PTF menus; consult the advisory for exact PTF numbers per release. As a compensating control where immediate patching is not feasible, restrict network access to the affected IBM i interfaces to trusted internal networks or VPN-connected hosts, and enforce the principle of least privilege for all IBM i user profiles to reduce the pool of accounts that could be leveraged. Audit IBM i user profile authorities (USRPRF) and remove unnecessary *ALLOBJ or elevated authorities. Note that network-level restrictions alone do not eliminate risk if the vulnerable interface is internally accessible.