EUVD-2026-62755
GHSA-73fm-w554-wj2g
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector confirmed by environment-variable injection requiring shell access; PR:L because any authenticated local user suffices; full CIA impact reflects potential root code execution.
Primary rating from Vendor (ibm).
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to improperly scrubbed environment variables.
AnalysisAI
Local arbitrary code execution in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 stems from improperly scrubbed environment variables (CWE-426: Untrusted Search Path), allowing a low-privileged local user to inject malicious values such as PATH or LD_PRELOAD that are subsequently consumed by a privileged process. With a CVSS score of 7.8 (HIGH) and full confidentiality, integrity, and availability impact, successful exploitation yields arbitrary code execution at an elevated privilege level. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated local user account with the ability to spawn a shell session on the affected IBM AIX 7.2/7.3 or PowerVM VIOS 4.1 system - this is confirmed by the CVSS vector PR:L (low privileges required). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates local network access with low complexity and low privileges required, meaning any authenticated shell user on the system can attempt exploitation without user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged user with an interactive shell on an AIX 7.3 system sets the LD_PRELOAD or PATH environment variable to point to a malicious shared library or executable residing in a world-writable directory under their control. When a setuid-root binary - such as a system utility that does not sanitize inherited environment variables - is executed in that session, the dynamic linker or command resolution mechanism loads the attacker's code with root privileges, resulting in full system compromise. … |
| Remediation | Apply the vendor-released fix packages detailed in IBM security advisory at https://www.ibm.com/support/pages/node/7283858 - this is the primary and definitive remediation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running IBM AIX 7.2, 7.3, or PowerVM VIOS 4.1 in your environment and contact IBM support to verify available patch versions specific to your deployed releases. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
IBM AIX 7.2 and 7.3 nimesis NIM master service could allow a remote attacker to execute arbitrary commands due to improp
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an unauthenticated remote attacker to run a
Same weakness CWE-426 – Untrusted Search Path
View allShare
External POC / Exploit Code
Leaving vuln.today