CVE-2026-18824: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in IBM AIX

This vulnerability (CVE-2026-18824) affects IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It is caused by improper neutralization of special elements in OS commands, classified as CWE-78 (OS Command Injection). A remote attacker with authentication can exploit this flaw to execute arbitrary commands on the affected systems. The CVSS v3.1 base score is 8.4, indicating high severity, with attack vector network, low attack complexity, high privileges required, and user interaction needed. The vulnerability impacts confidentiality, integrity, and availability of the system.

Successful exploitation allows a remote authenticated attacker to execute arbitrary OS commands, potentially leading to full system compromise affecting confidentiality, integrity, and availability. The attacker must have high privileges and user interaction is required, which limits the ease of exploitation but still poses a significant risk.

No patch or official fix information is currently provided. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, restrict access to affected systems to trusted users only and monitor for suspicious activity involving command execution.