IBM i versions 7.3 through 7.6 contain an OS command injection vulnerability (CWE-78) that arises from improper neutralization of special elements in input, allowing remote authenticated attackers to execute arbitrary Control Language commands. The vulnerability has a CVSS 3.1 base score of 8.3, indicating high severity with network attack vector, low attack complexity, and no user interaction required. The vulnerability affects confidentiality and integrity substantially, with a low impact on availability. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation could allow an authenticated remote attacker to execute arbitrary Control Language commands on affected IBM i systems, potentially leading to unauthorized disclosure and modification of sensitive data. The availability impact is low, indicating limited disruption to system operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict remote authenticated access to IBM i systems and monitor for suspicious activity related to command execution. Follow IBM's official channels for updates on patches or mitigations.