EUVD-2026-62732
GHSA-c694-2687-m8gx
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:A confirmed by adjacent-network constraint; PR:N and UI:N consistent with description of remote unauthenticated exploitation; full C/I/A:H reflects arbitrary OS command execution.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
AnalysisAI
OS command injection in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 allows an adjacent network attacker without credentials to execute arbitrary operating system commands. The flaw (CWE-78) arises from improper neutralization of special elements passed to OS command constructors, exposing the full confidentiality, integrity, and availability of affected hosts. No public exploit or CISA KEV listing has been identified at time of analysis, though a vendor patch is available via IBM Support.
Technical ContextAI
CWE-78 (Improper Neutralization of Special Elements used in an OS Command - 'OS Command Injection') occurs when user-controlled input is concatenated into a shell command without adequate sanitization or escaping, allowing injection of additional commands. Affected products are IBM AIX 7.2 and 7.3 (a mature enterprise UNIX operating system running on IBM Power hardware) and IBM PowerVM VIOS 4.1 (the Virtual I/O Server that mediates I/O resource sharing among AIX and Linux LPARs on IBM Power Systems). The CPE strings 'cpe:2.3:a:ibm:aix:*:*:*:*:*:*:*:*' and 'cpe:2.3:a:ibm:powervm_vios:*:*:*:*:*:*:*:*' indicate the full version ranges within those major releases are affected. Because VIOS acts as a privileged infrastructure component for virtualised environments, exploitation there carries potential for lateral impact across co-hosted LPARs.
RemediationAI
Apply the vendor-released patch referenced in the IBM Security Advisory at https://www.ibm.com/support/pages/node/7283858. Exact fixed versions (e.g., specific AIX Technology Levels or VIOS fix packs) are not enumerated in the available intelligence and must be confirmed from that advisory before deployment. As a compensating control pending patching, restrict network adjacency to AIX and VIOS management interfaces using VLAN segmentation, firewall ACLs, or IBM HMC network isolation so that only authorised management hosts can reach the affected services - this directly addresses the AV:A attack vector. Disabling or firewalling any network-exposed service identified by IBM as the injection point (once confirmed via the advisory) would further reduce exposure. Note that segmentation does not eliminate risk if the attacker is already inside the management VLAN.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today