Executive brief
IBM i is a business-critical operating system used by enterprises for mission-critical applications and data processing. A local authenticated attacker can inject malicious parameters into CL (Control Language) commands due to improper input validation, potentially allowing unauthorized command execution or data manipulation. This vulnerability requires local access and authentication, limiting its immediate threat scope but still representing a significant insider risk.
Technical details
This vulnerability is a CL command parameter injection flaw (CWE-78: Improper Neutralization of Special Elements used in an OS Command) affecting IBM i's Debug Server component. An authenticated local attacker can inject specially crafted parameters into CL commands that are not properly neutralized, allowing arbitrary command execution or parameter modification. The attack vector is local, requires authentication credentials, and does not require user interaction. The vulnerability affects IBM i versions 7.3, 7.4, 7.5, and 7.6, with patches available via PTF numbers SJ11308, SJ11307, SJ11306, and SJ11305 respectively.
Affected products
- IBM i 7.3, 7.4, 7.5, 7.6
Timeline
- 2026-09-04: disclosed
- 2026-09-04: patched: PTF SJ11305 (7.6), SJ11306 (7.5), SJ11307 (7.4), SJ11308 (7.3)