IBM AIX versions 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain an OS command injection vulnerability (CWE-78) due to improper neutralization of special elements in OS commands. This flaw could allow a remote attacker with authenticated access to execute arbitrary commands on the affected systems. The CVSS 3.1 base score is 8.4, reflecting high impact on confidentiality, integrity, and availability. The vulnerability requires low attack complexity but high privileges and user interaction. No known exploits are reported in the wild, and no official remediation level or patch information is currently available.

Successful exploitation could lead to complete compromise of affected systems, including full control over confidentiality, integrity, and availability. The attacker must be authenticated and have high privileges, and user interaction is required. This could result in arbitrary command execution on the host operating system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to affected systems to trusted users only and monitor for suspicious activity. Follow IBM's security advisories for updates on patches or mitigations.