EUVD-2026-62874
GHSA-fr5c-wjc9-q28p
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector because exploitation requires an existing local account; PR:L because a standard user account suffices; full C/I/A because root access grants complete system control.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain root privileges due to improper enforcement of RBAC authentication roles.
AnalysisAI
Local privilege escalation in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables a low-privileged authenticated user to gain root access by bypassing RBAC role enforcement. The flaw (CWE-269: Improper Privilege Management) means the operating system fails to correctly enforce the boundaries between assigned RBAC roles, allowing a standard user to assume or exercise privileges reserved for root. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
IBM AIX implements Role-Based Access Control (RBAC) as a fine-grained privilege management framework that assigns specific roles - each with scoped capabilities - to users, so that not every administrator needs root. CWE-269 (Improper Privilege Management) captures flaws where role enforcement logic fails: the system either allows a lower-privileged role to invoke capabilities of a higher role, or fails to validate role membership at the point of privilege exercise. The affected products - IBM AIX 7.2 and 7.3 (CPE: cpe:2.3:a:ibm:aix:*:*:*:*:*:*:*:*) and IBM PowerVM VIOS 4.1 (CPE: cpe:2.3:a:ibm:powervm_vios:*:*:*:*:*:*:*:*) - are Unix-derived operating systems running on IBM POWER architecture. AIX is common in high-availability enterprise and financial sector environments; PowerVM VIOS is a dedicated virtualization partition managing I/O resources for other logical partitions, making it a particularly sensitive target.
RemediationAI
IBM has released a patch for this vulnerability; administrators should apply the vendor-provided fix as detailed in the IBM security advisory at https://www.ibm.com/support/pages/node/7283858. The advisory should be consulted for the exact fixed fix pack or Technology Level, as the available data does not enumerate a specific version string. Until patching is complete, compensating controls include: auditing all local user accounts on affected AIX and VIOS systems and removing shell access for any account that does not require it (note this may disrupt legitimate administrative workflows and requires coordination with operations); reviewing RBAC role assignments via the lsrole and lsuser commands to minimize the number of users with any non-default role assigned; and enabling the AIX audit subsystem to log role-related system calls (su, setuid, role-related syscalls) to detect exploitation attempts, though this increases log volume and requires a log review process.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today