EUVD-2026-63716
GHSA-pjqq-8r6c-4f8w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed AIX/VIOS service over network
-
DeliveryBypass improper authentication check
-
ExploitReach privileged command handler
-
ExecutionExecute arbitrary commands on host
-
ImpactCompromise system or hosted partitions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The CVSS vector is AV:N/AC:L/PR:N/UI:N, indicating no special conditions - remote unauthenticated exploitation against network-reachable IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 instances. The primary limiting factor is network exposure of the vulnerable service: exploitation requires reachability to the specific AIX/VIOS daemon or interface handling the flawed authentication, which in hardened environments is often confined to a management network. The exact vulnerable service is not named in the available NVD data, so defenders should confirm which listening component is affected via IBM's advisory before assessing exposure. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) describes a worst-case profile: network-exploitable, low complexity, no privileges, no user interaction, with total confidentiality, integrity, and availability impact - consistent with a remote unauthenticated command-execution authentication bypass. No EPSS score, SSVC decision, or POC signal was provided, so probabilistic exploitation likelihood cannot be quantified from this data, and the absence of KEV listing means active exploitation is not confirmed. That said, the combination of an authentication bypass, critical impact, and the sensitivity of VIOS as a virtualization control point means any operator running these versions should treat this as urgent patching priority regardless of the missing EPSS data. The one caveat is that the exact exploitation surface is undocumented in the NVD reference, so the network-reachability assumption should be validated against how the vulnerable service is actually exposed in a given environment. |
| Exploit ScenarioDerived | A remote attacker with network access to an exposed AIX or VIOS service sends crafted requests that bypass the authentication check and reach a command-execution path, then runs arbitrary commands on the host without any valid credentials or user interaction. On a VIOS host this could compromise the virtualization layer serving multiple LPARs. No public proof-of-concept exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
Improper authentication in IBM AIX 7.2 and 7.3, and in IBM PowerVM VIOS 4.1, allows a remote attacker to execute arbitrary commands on affected systems. The flaw carries a critical CVSS 9.8 rating (network-reachable, no privileges or user interaction) and, per IBM's own PSIRT advisory, an authentication bypass can lead to full command execution. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
RemediationAI
Apply the fix referenced in IBM's security advisory at https://www.ibm.com/support/pages/node/7283858; the input does not include an exact fix fileset or ifix number, so the specific patched version should be taken directly from that advisory (patch available per vendor advisory). Until the patch or interim fix (ifix) is applied, restrict network reachability to AIX and VIOS management interfaces - place VIOS and AIX administrative services behind a management VLAN or firewall so only trusted administrative hosts can reach them, accepting that this may complicate remote administration and require jump-host access. Given this is an authentication bypass, also review authentication logs on the affected service for anomalous access, and consider disabling or firewalling any non-essential remotely-exposed daemon on VIOS until remediation is confirmed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected technology is IBM's AIX operating system (a proprietary Unix for IBM Power Systems) and the Virtual I/O Server (VIOS) component of PowerVM, which brokers virtualized storage and network resources to LPAR partitions. The root cause is classified as CWE-287 (Improper Authentication), meaning an authentication mechanism can be bypassed or satisfied without valid credentials, allowing an unauthenticated actor to reach a privileged command-execution path. Because VIOS underpins virtualization for Power hardware, a weakness here potentially exposes the management plane of multiple hosted partitions. The specific service, protocol, or daemon exposing the flawed authentication is not detailed in the available NVD data and would need to be confirmed from IBM's advisory (node/7283858).
Know when Aix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
An unauthenticated remote authentication bypass yielding arbitrary command execution justifies AV:N/AC:L/PR:N/UI:N with full C/I/A impact.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper authentication.
Executive ViewAI
CVE-2026-17142 is a critical unauthenticated remote code execution vulnerability in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 that allows network attackers to execute arbitrary commands without credentials or user interaction. No vendor patch is currently available, leaving affected infrastructure vulnerable to immediate compromise by any attacker with network access. Organizations running these core platforms face severe risk to operational continuity and data security.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement strict network segmentation restricting affected systems to trusted administrative networks only; (2) Enforce granular access controls on SSH, Telnet, and management interfaces; (3) Deploy intrusion detection signatures to monitor for exploitation patterns; (4) Implement egress filtering to limit data exfiltration if compromise occurs; (5) Enable comprehensive audit logging and real-time alerting for all remote access attempts; (6) Consider air-gapping or isolating business-critical systems from production networks pending patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Exploit-DB