An OS command injection vulnerability in IBM i versions 7.5 and 7.6 allows authenticated users to execute unauthorized commands, risking total system compromise.

The system fails to properly neutralize special elements within OS commands (CWE-78). This vulnerability is accessible to authenticated users, allowing them to manipulate command arguments to execute malicious code.

The CVSS score of 8.8 underscores the high severity of this vulnerability. Compromise could result in the total loss of confidentiality, integrity, and availability of the affected IBM i environment, creating significant risk for businesses relying on these systems for core operations.

Immediate Action: Apply the required PTFs provided by IBM: SJ10931 for version 7.6 and SJ11010 for version 7.5.

Proactive Monitoring: Monitor for anomalous system behavior and unauthorized changes to system configurations that could indicate attempted command injection.

Compensating Controls: Utilize existing security tools to restrict the execution of shell commands and enforce strict input validation for any interface that interacts with the OS.

Public Exploit Available: Unknown

Immediate action is recommended to mitigate this high-severity vulnerability. Administrators should verify their current version and apply the designated PTFs to protect the integrity and security of their IBM i infrastructure.