EUVD-2026-62514
GHSA-cqrp-mxgc-jj3v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Improper authentication bypass yielding root over the network with no privileges or interaction justifies AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H; scope unchanged.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to gain root privileges due to improper authentication.
AnalysisAI
Remote privilege escalation to root in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 stems from an improper authentication weakness (CWE-287) that lets an unauthenticated network attacker bypass identity checks and obtain root-level control. The CVSS 9.8 rating reflects a network-reachable, low-complexity flaw requiring no privileges or user interaction, with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the severity and unauthenticated network vector make it a high-priority patching target for IBM Power estates.
Technical ContextAI
The affected platforms are IBM's proprietary Unix operating system AIX (cpe:2.3:a:ibm:aix) and the PowerVM Virtual I/O Server (cpe:2.3:a:ibm:powervm_vios), a virtualization appliance that brokers storage and network I/O for LPARs on IBM Power hardware. The root-cause class is CWE-287 Improper Authentication, meaning a service or authentication path fails to correctly verify the identity of a requester, allowing an attacker to be treated as an authorized (here, root-privileged) principal. Because VIOS underpins virtualization for entire Power frames, a compromise of that layer can cascade to the guest partitions it services.
RemediationAI
Patch available per vendor advisory: apply the fix published by IBM at https://www.ibm.com/support/pages/node/7283858 for the affected AIX 7.2/7.3 and PowerVM VIOS 4.1 systems, confirming the exact fixed technology level or ifix from that page since no precise fixed-version string was supplied in the input. Until patching completes, reduce exposure of the vulnerable authentication surface by restricting network reachability of AIX and VIOS management/service interfaces to trusted administrative networks or jump hosts, blocking access from general and internet-facing segments; on VIOS specifically, tightly firewall the management interface and separate it from guest/tenant traffic. These network restrictions can disrupt legitimate remote administration and monitoring tooling, so validate management paths before enforcing them, and prioritize the vendor fix as the durable remediation.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today