An OS command injection vulnerability in IBM i versions 7.3 through 7.6 allows an authenticated attacker to execute arbitrary commands, creating a risk of full system compromise.

This is an OS command injection flaw (CWE-78) where improper neutralization of special elements allows an attacker to inject and execute unauthorized commands. The vulnerability is accessible over the network and requires the attacker to have low privileges on the system.

This vulnerability carries a CVSS score of 8.8, indicating a high risk of total system compromise. An attacker who successfully executes arbitrary commands can manipulate the underlying operating system, potentially leading to unauthorized data access, system disruption, or the installation of persistent malicious software.

Immediate Action: Apply the necessary PTF updates provided by IBM: SJ10887 for version 7.6, SJ10888 for 7.5, SJ10890 for 7.4, and SJ10891 for 7.3.

Proactive Monitoring: Monitor system logs for unusual command execution patterns or unauthorized process spawning that deviates from normal administrative activity.

Compensating Controls: Implement strict network segmentation and ensure that administrative interfaces are not reachable from untrusted network segments.

Public Exploit Available: No

The ability to execute arbitrary OS commands represents a critical security failure that should be addressed immediately. System administrators must schedule and apply the provided patches to eliminate the risk of command injection and maintain the security posture of their IBM i environments.