IBM i versions 7.3 through 7.6 contain an OS command injection vulnerability (CWE-78) where insufficient sanitization of special shell characters allows a remote authenticated attacker to execute arbitrary commands on the underlying operating system. The CVSS 3.1 base score is 8.8, reflecting network attack vector with low attack complexity, requiring privileges but no user interaction, and resulting in high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published yet, and no known exploits in the wild have been reported.

Successful exploitation enables remote authenticated attackers to execute arbitrary OS commands, potentially leading to full system compromise including unauthorized data access, modification, or disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict remote authenticated access to trusted users only and monitor for suspicious command execution activities related to this vulnerability.