This vulnerability (CVE-2026-16848) affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1. It arises from improper neutralization of special elements used in OS commands (CWE-78), specifically shell metacharacters in DHCP options. This flaw could enable a remote attacker to execute arbitrary commands on the affected systems. The CVSS v3.1 base score is 8.8, indicating high severity, with attack vector being adjacent network, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported at this time.

Successful exploitation could allow a remote attacker to execute arbitrary commands on affected IBM AIX systems, potentially leading to full compromise of confidentiality, integrity, and availability of the system. The vulnerability does not require privileges or user interaction, increasing its risk in environments where DHCP options can be influenced by an attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to DHCP services and monitor network segments to limit exposure to potentially malicious DHCP traffic.