CVE-2026-18073: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

IBM i versions 7.3 through 7.6 contain a vulnerability classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). This flaw allows a local authenticated attacker to inject parameters into a CL command, potentially leading to unintended command execution. The vulnerability is confirmed and published but lacks an official remediation level or patch information. The CVSS 3.1 base score is 4.4, reflecting a medium severity with local attack vector, low complexity, and requiring privileges.

An authenticated local attacker could exploit this vulnerability to inject parameters into CL commands, potentially leading to limited confidentiality and integrity impacts. There is no indication of availability impact. The attack requires local access and privileges, limiting the scope of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users and monitor for suspicious command usage related to CL commands.