EUVD-2026-62873
GHSA-fvfc-rh3q-hmjf
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector and low-privilege requirement reflect a local authenticated user injecting metacharacters; full C/I/A impact consistent with arbitrary OS command execution potential.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to shell metacharacter injection.
AnalysisAI
Shell metacharacter injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a local low-privileged attacker to execute arbitrary OS commands, resulting in complete confidentiality, integrity, and availability compromise per CVSS C:H/I:H/A:H. The root cause (CWE-78) is insufficient sanitization of special shell characters passed to an OS interpreter within an IBM-provided utility or script. IBM has released a patch; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
CWE-78 (Improper Neutralization of Special Elements in an OS Command) describes failures where user-controllable input containing shell metacharacters - such as semicolons, pipe symbols, backticks, or command substitution sequences like $() - is passed unsanitized to a shell interpreter, allowing injection of attacker-chosen commands alongside the intended operation. IBM AIX (Advanced Interactive eXecutive) is IBM's enterprise UNIX operating system running on POWER-architecture hardware; PowerVM VIOS (Virtual I/O Server) is the specialized AIX-derived partition that provides virtualized I/O resources to guest LPARs in PowerVM environments. Both platforms expose administrative utilities and scripts that may process user or environment input. CPE strings cpe:2.3:a:ibm:aix and cpe:2.3:a:ibm:powervm_vios confirm both product families as affected. The specific vulnerable component within AIX or VIOS is not identified in available intelligence; the IBM advisory at https://www.ibm.com/support/pages/node/7283858 should be consulted for component-level detail.
RemediationAI
IBM has released a patch per its security advisory at https://www.ibm.com/support/pages/node/7283858; administrators should consult this advisory to identify and apply the specific APARs or PTFs applicable to their AIX 7.2, AIX 7.3, or PowerVM VIOS 4.1 maintenance level. Exact fix version numbers are not independently confirmed from available data - do not infer a specific version without referencing the advisory directly. As a compensating control prior to patching, enforce the principle of least privilege on AIX and VIOS systems: audit and remove unnecessary local shell accounts, restrict sudo rules to specific commands rather than open shells, and review setuid/setgid binaries for exposure to the vulnerable component. On PowerVM VIOS partitions, restricting padmin account access to only required virtual I/O operations may reduce the attack surface, though this may impact legitimate VIOS administrative workflows and should be tested before deployment.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today