EUVD-2026-63712
GHSA-4x62-vxrg-5r3p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed AIX/VIOS service
-
DeliverySend input with format specifiers
-
ExploitTrigger CWE-134 format string flaw
-
ExecutionLeak memory and corrupt via %n
-
PersistHijack control flow
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Format string safety
|
| Exploitation Conditions | The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required and the attack is remote and low-complexity against the affected AIX 7.2/7.3 and VIOS 4.1 releases. The concrete prerequisite that cannot be confirmed from the input is which network-facing service or feature processes the attacker-controlled format string - the description does not name the vulnerable daemon, port, or configuration, so the practical limiting factor is network reachability of that unspecified component; verify the exact affected service against IBM advisory node 7283858 before assuming any default-configuration listener is exploitable. |
| Impact | Multiple raw signals point to high priority: the CVSS 3.1 base score is 9.8 with a fully remote, low-complexity, no-privilege, no-interaction vector (AV:N/AC:L/PR:N/UI:N) and high impact to confidentiality, integrity, and availability. However, several corroborating signals are absent - no EPSS probability, no KEV listing, no POC, and no SSVC decision data were provided - so the picture is 'critical on paper' without independent evidence of exploitation likelihood yet. There is also a specificity gap: the description states 'remote attacker' but does not name the vulnerable service or daemon, which is unusual for AIX advisories and warrants verification against IBM's advisory before assuming default-configuration internet-facing exposure. Given AIX/VIOS typically run business-critical Power workloads, defenders should treat a 9.8 RCE as urgent and patch promptly while confirming which listening component is affected, rather than downgrading it solely because EPSS/KEV data is missing. |
| Exploit ScenarioDerived | An attacker with network access to an exposed AIX or VIOS service sends crafted input containing format-string specifiers to a routine that passes it directly to a printf-family function. By combining read specifiers to leak memory layout with write primitives, the attacker corrupts process memory to hijack control flow and execute arbitrary code on the host; no public POC is identified at time of analysis, and the exact target service is not disclosed in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 arises from a format string weakness (CWE-134) that a remote, unauthenticated attacker can leverage to run arbitrary code, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scoring 9.8 critical. IBM PSIRT is the reporting source and a single vendor support advisory is referenced; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. The affected component or listening service is not named in the available data, so the exact remote entry point is unconfirmed.
RemediationAI
Apply IBM's fix as described in the referenced advisory at https://www.ibm.com/support/pages/node/7283858 (IBM support node 7283858); no exact patched fileset version was included in the input, so the status is best described as patch available per vendor advisory rather than a confirmed version number - obtain the specific APAR/iFix and Technology Level from that page. Until the fix is applied, restrict network reachability to AIX and VIOS management and service interfaces by placing them behind firewalls and management VLANs, limiting access to trusted administrative hosts, and monitoring for anomalous input to any exposed daemons; because the affected service is not named in the data, network-level isolation of VIOS/AIX interfaces is the most reliable compensating control, with the trade-off that legitimate remote administration paths must be explicitly allowlisted to avoid operational disruption.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-134 (Use of Externally-Controlled Format String), where attacker-influenced input reaches a format-string parameter of a printf-family function without a fixed format specifier. On IBM AIX (IBM's proprietary POSIX/UNIX operating system for Power Systems) and its virtualization layer PowerVM VIOS (Virtual I/O Server, which provides virtualized storage and networking to LPARs), such a flaw can allow memory disclosure via specifiers like %x/%s and memory corruption or controlled writes via %n, culminating in code execution. No CPE strings were supplied, so exact fileset/component identification is limited to the version families stated by IBM: AIX 7.2, AIX 7.3, and VIOS 4.1.
Know when Aix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor describes remote unauthenticated code execution via format string, matching AV:N/AC:L/PR:N/UI:N with full C/I/A impact; unnamed service prevents lowering AV, so I retain network vector.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a format string vulnerability.
Executive ViewAI
A critical remote code execution vulnerability (CVSS 9.8) in IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1 allows unauthenticated attackers to execute arbitrary code, with no vendor patch currently available. Organizations running these systems face critical infrastructure risk; while no public exploit exists yet, the unpatched state means any disclosure could immediately enable attackers to gain complete operational control of affected systems.
No vendor-released patch identified at time of analysis. Interim mitigations include: strict network segmentation to limit remote access to affected systems, firewall rules blocking inbound connections to unknown services on AIX/PowerVM hosts, aggressive monitoring and logging for connection attempts and process execution anomalies, and consideration of taking systems offline or migrating workloads to patched AIX versions or alternative platforms until fixes are released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Exploit-DB