EUVD-2026-62871
GHSA-5mpc-4p97-jh8g
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states remote command execution with no stated authentication, matching AV:N/AC:L/PR:N/UI:N; OS command injection yields full C/I/A impact on the vulnerable host.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
AnalysisAI
Remote OS command injection in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a network attacker to execute arbitrary operating-system commands due to improper neutralization of special elements (CWE-78). The CVSS 3.1 base score is 9.8 with a network, no-privilege, no-interaction vector, and IBM has published a fix. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the combination of unauthenticated remote code execution on enterprise UNIX and virtualization infrastructure makes this a high-priority patch.
Technical ContextAI
The vulnerability is a CWE-78 OS command injection: user-controllable input reaches an operating-system shell or command interpreter without adequate sanitization/quoting, letting an attacker inject additional commands. The affected components per CPE are cpe:2.3:a:ibm:aix (IBM's proprietary UNIX operating system) and cpe:2.3:a:ibm:powervm_vios (the Virtual I/O Server that provides virtualized storage and network I/O to LPARs on IBM Power systems). Because VIOS underpins partition I/O on Power hardware, a command-injection flaw there can affect the virtualization control plane, not just a single workload. The specific vulnerable service, daemon, or command-line interface is not disclosed in the available data.
RemediationAI
Apply the vendor fix referenced in IBM's advisory at https://www.ibm.com/support/pages/node/7283858 (Patch available per vendor advisory); consult that page for the exact APAR/interim-fix or technology-level identifiers for AIX 7.2, AIX 7.3, and VIOS 4.1, as the input does not specify an exact patched version. Until patching is complete, reduce exposure of the affected management/service interfaces: restrict network reachability of AIX and VIOS to trusted management VLANs or jump hosts, block untrusted network access to the vulnerable service with host or network firewalls, and monitor for anomalous command execution - recognizing that on VIOS, restricting management access may complicate legitimate administration and automation, so schedule the fix promptly rather than relying on network controls long-term.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today