This vulnerability (CVE-2026-18835) involves improper neutralization of special elements used in OS commands (CWE-78) in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1. It enables a remote authenticated attacker to execute arbitrary commands on the affected systems. The CVSS v3.1 base score is 9.9, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and complete impact on confidentiality, integrity, and availability. The vendor has not yet provided a remediation level or patch information.

Successful exploitation allows remote authenticated attackers to execute arbitrary OS commands, potentially leading to full system compromise including unauthorized data access, modification, and denial of service. The vulnerability affects critical IBM enterprise operating systems and virtualization environments, posing a severe risk to affected deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict remote authenticated access to affected systems and monitor for suspicious command execution activities. Follow IBM's security advisories for updates.