EUVD-2026-62525
GHSA-8rgq-x42p-vx92
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable, low-complexity command injection needing only a low-privilege account (PR:L); OS command execution escaping the application context justifies S:C with full C/I/A impact.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
AnalysisAI
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute arbitrary operating-system commands due to improper neutralization of special elements (CWE-78). Rated CVSS 9.9 with a scope change, a successful low-privilege attacker can break out of the application context and run commands on the underlying enterprise Unix host, threatening confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and network reachability make it a high-priority patch.
Technical ContextAI
AIX is IBM's proprietary Unix operating system for POWER-architecture servers, and PowerVM VIOS (Virtual I/O Server) is the AIX-based appliance that virtualizes storage and network I/O for LPARs on those systems. The flaw is a classic CWE-78 OS Command Injection: user-controllable input is passed into a shell or system command constructor without adequate sanitization/escaping, so shell metacharacters (';', '|', '&', '$()', backticks) are interpreted as command separators rather than literal data. The affected CPEs are cpe:2.3:a:ibm:aix and cpe:2.3:a:ibm:powervm_vios, indicating the injectable code path exists in an AIX/VIOS management or service component reachable over the network by an authenticated principal.
RemediationAI
Apply the vendor fix: IBM has released a patch, documented in the IBM support advisory at https://www.ibm.com/support/pages/node/7283858 - install the AIX 7.2/7.3 or PowerVM VIOS 4.1 iFix/APAR or Technology Level/Service Pack level referenced there (exact patched build is not restated in this input, so pull the precise level from the advisory). Patch available per vendor advisory; no exact fix version string was included in the source data, so do not assume a version number - verify against IBM. Until patched, reduce exposure by restricting network access to the affected AIX/VIOS management and service interfaces to trusted administrative networks only (firewall/ACL the relevant ports), tightening and auditing low-privilege accounts that can reach the vulnerable component, and enforcing least privilege so fewer principals meet the PR:L precondition; the trade-off is that network restrictions may disrupt legitimate remote management workflows and must be tested against operational access needs.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
IBM AIX 7.2 and 7.3 nimesis NIM master service could allow a remote attacker to execute arbitrary commands due to improp
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today