IBM i versions 7.5 and 7.6 contain an OS command injection vulnerability (CWE-78) that could allow a remote authenticated attacker to execute arbitrary commands with elevated privileges. The issue arises from improper neutralization of special elements used in OS commands, enabling command injection. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, requiring privileges but no user interaction, and impacts confidentiality, integrity, and availability. No vendor advisory or patch information is currently provided.

Successful exploitation could allow an authenticated remote attacker to execute arbitrary OS commands with elevated privileges on affected IBM i systems, potentially leading to full system compromise including unauthorized data access, modification, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict remote authenticated access to IBM i 7.5 and 7.6 systems and monitor for suspicious activity related to command execution.