CVE-2026-17499: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

This vulnerability (CVE-2026-17499) in IBM i versions 7.3 through 7.6 involves improper neutralization of special elements used in operating system commands, classified as CWE-78 (OS Command Injection). This flaw could enable a local attacker with limited privileges to execute arbitrary OS commands, potentially impacting system integrity and availability. The CVSS 3.1 vector indicates local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

The vulnerability allows local attackers to execute arbitrary OS commands, which could lead to limited integrity and availability impacts on affected IBM i systems. Confidentiality is not affected. The attack requires local access and low privileges, with no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, monitor IBM's security advisories for updates. Until a patch is available, restrict local access to trusted users only to reduce risk.