EUVD-2026-62755
GHSA-73fm-w554-wj2g
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector confirmed by environment-variable injection requiring shell access; PR:L because any authenticated local user suffices; full CIA impact reflects potential root code execution.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to improperly scrubbed environment variables.
AnalysisAI
Local arbitrary code execution in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 stems from improperly scrubbed environment variables (CWE-426: Untrusted Search Path), allowing a low-privileged local user to inject malicious values such as PATH or LD_PRELOAD that are subsequently consumed by a privileged process. With a CVSS score of 7.8 (HIGH) and full confidentiality, integrity, and availability impact, successful exploitation yields arbitrary code execution at an elevated privilege level. No public exploit or CISA KEV listing has been identified at time of analysis, though a vendor patch is available via IBM support.
Technical ContextAI
IBM AIX is a Unix-based operating system running on IBM POWER hardware, and PowerVM VIOS (Virtual I/O Server) is a specialized AIX-based hypervisor component for IBM Power Systems. CWE-426 (Untrusted Search Path) describes a class of vulnerability where a privileged process - typically a setuid/setgid binary or system daemon - inherits and uses environment variables (e.g., PATH, LD_LIBRARY_PATH, LD_PRELOAD, IFS) supplied by a lower-privileged calling process without adequately sanitizing or clearing them. On AIX and VIOS, such variables can redirect dynamic linker resolution or executable lookup to attacker-controlled paths, causing the privileged process to load or execute malicious code. Affected CPEs are cpe:2.3:a:ibm:aix:*:*:*:*:*:*:*:* (versions 7.2 and 7.3) and cpe:2.3:a:ibm:powervm_vios:*:*:*:*:*:*:*:* (version 4.1).
RemediationAI
Apply the vendor-released fix packages detailed in IBM security advisory at https://www.ibm.com/support/pages/node/7283858 - this is the primary and definitive remediation. IBM AIX interim fixes and technology level updates are distributed via the IBM Fix Central portal; administrators should identify the specific APAR (Authorized Problem Analysis Report) cited in the advisory and apply the corresponding fileset update. For PowerVM VIOS 4.1, the fix should be applied during a scheduled maintenance window as VIOS updates typically require careful coordination with guest virtual machine workloads. As a compensating control prior to patching, restrict local login access to AIX and VIOS systems to only operationally required accounts, enforce PAM or AIX RBAC policies to limit which users can access shells that interact with privileged binaries, and audit setuid/setgid binaries with 'find / -perm -4000 -o -perm -2000' to identify processes most likely to inherit tainted environment variables. Note that restricting local accounts may impact legitimate administrative workflows and should be coordinated with operations teams.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-426 – Untrusted Search Path
View allShare
External POC / Exploit Code
Leaving vuln.today