This vulnerability (CVE-2026-16875) affects IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1. It is classified as CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). A local attacker with limited privileges can exploit shell metacharacter injection to execute arbitrary commands on the affected system. The CVSS v3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official remediation or patch information is currently provided.

Successful exploitation allows a local attacker to execute arbitrary OS commands, potentially leading to full system compromise affecting confidentiality, integrity, and availability of the system. The attacker requires local access with some privileges but no user interaction is needed. This can result in unauthorized command execution and control over the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor IBM's advisories for updates. Until a patch is available, restrict local access to trusted users only and apply any recommended workarounds from IBM if published.