EUVD-2026-62863
GHSA-636f-3mph-97g9
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Consistent with vendor-provided vector: network-reachable, high complexity, no auth, limited read-only confidentiality impact only.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to a path traversal vulnerability.
AnalysisAI
Path traversal in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 exposes sensitive files to remote, unauthenticated attackers over the network. The flaw (CWE-22) allows directory traversal sequences to escape an intended path boundary, enabling read access to files that should not be externally accessible. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Technical ContextAI
CWE-22 (Path Traversal) arises when software fails to sanitize user-supplied input before using it to construct file system paths, allowing sequences such as '../' to escape a restricted directory. The affected products - IBM AIX 7.2 and 7.3 (a Unix-based enterprise operating system for IBM POWER hardware) and IBM PowerVM VIOS 4.1 (the Virtual I/O Server layer that manages virtualized I/O resources on IBM POWER systems) - are identified in CPE strings cpe:2.3:a:ibm:aix:*:*:*:*:*:*:*:* and cpe:2.3:a:ibm:powervm_vios:*:*:*:*:*:*:*:*. The broad wildcard CPE versions indicate all sub-versions of the named major releases may be affected until the vendor-confirmed patch is applied.
RemediationAI
A patch is available from IBM per the vendor advisory at https://www.ibm.com/support/pages/node/7283858; administrators should consult that page to obtain the specific fix version for their AIX 7.2, 7.3, or PowerVM VIOS 4.1 deployment - exact patched version numbers are not independently confirmed from available data and should be verified directly against the IBM fix list. As a compensating control prior to patching, administrators should review and restrict network exposure of any AIX or VIOS services that handle file path input, and enforce egress filtering to minimize attacker ability to exfiltrate retrieved data. Tightening filesystem permissions on sensitive directories limits what an attacker can read even if traversal succeeds, with the trade-off of potential operational disruption to legitimate administrative tooling.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today