CVE-2026-16521 is an OS command injection vulnerability caused by insufficient input filtering in a BMC function. An attacker with high privileges can inject malicious commands that may execute when the related service is restarted. This vulnerability has a high severity score of 7.2 and impacts confidentiality, integrity, and availability.