EUVD-2026-63717
GHSA-2fr6-wpcj-w435
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed AIX/VIOS service over network
-
DeliverySend crafted request abusing privilege management
-
ExploitBypass intended privilege boundary
-
ExecutionExecute arbitrary code in elevated context
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The available description names no special feature flag or non-default configuration, and the CVSS vector is AV:N/AC:L/PR:N/UI:N, which nominally implies remote unauthenticated exploitation against AIX 7.2/7.3 or PowerVM VIOS 4.1 with no user interaction. The key limiting factors are: the attacker must have network reachability to the affected AIX/VIOS service, and the target must be running the specific vulnerable versions on POWER hardware. Caveat: the CWE-269 root cause typically requires some pre-existing account or local privilege to escalate, which is not reconciled with the PR:N rating in the source data - defenders should verify with IBM whether prior access is actually a prerequisite before rating this as internet-exploitable. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) signals worst-case network, unauthenticated, low-complexity RCE, which alone justifies urgent patching. However, there is tension worth flagging: CWE-269 (improper privilege management) usually implies an actor already has some foothold or local privilege to escalate, which conflicts with the PR:N/AV:N framing of remote unauthenticated code execution - verify the true attack surface with IBM before assuming internet-facing exploitability. No EPSS score, KEV listing, POC, or SSVC data was supplied, so exploitation probability cannot be quantified from the input. Net: treat as high priority for Power/AIX estates given the CVSS and vendor (IBM PSIRT) sourcing, but recognize that the reachability details are unconfirmed and the description-vs-CWE mismatch is unresolved. |
| Exploit ScenarioDerived | An attacker with network access to an exposed AIX or VIOS service sends crafted input that abuses the improper privilege-management flaw to execute code in a higher-privileged context, gaining control of the host. No public proof-of-concept is known at time of analysis, and the low attack complexity (AC:L) suggests exploitation would be straightforward once the vulnerable path is reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from improper privilege management (CWE-269), letting a remote attacker run arbitrary code on affected Power systems per IBM PSIRT. The 9.8 CVSS score reflects a network-reachable, low-complexity vector with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the IBM support advisory indicates a fix is available.
RemediationAI
Patch available per vendor advisory - apply the IBM-provided iFix/APAR referenced at https://www.ibm.com/support/pages/node/7283858 for the specific AIX 7.2, AIX 7.3, and VIOS 4.1 technology levels in your environment; no exact fixed version string was included in the input, so obtain the precise iFix identifier from that advisory rather than assuming a version. Until fixes are staged, reduce exposure by restricting network reachability of AIX/VIOS management and service interfaces to trusted administrative networks and blocking untrusted access at the firewall, and tighten VIOS access since it fronts virtualized I/O for multiple LPARs (note the trade-off that over-restrictive filtering can disrupt legitimate LPAR provisioning and HMC/management traffic). Because the exact vulnerable component is undisclosed, prioritize the vendor iFix over ad hoc service disablement.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM AIX is IBM's proprietary Unix operating system for POWER architecture servers, and PowerVM VIOS (Virtual I/O Server) is the AIX-derived appliance that virtualizes storage and network resources for LPARs on Power hardware. The root cause is CWE-269 Improper Privilege Management, a class where a component fails to correctly assign, drop, or enforce privilege boundaries, allowing an actor to operate with more privilege than intended. No CPE strings were provided in the input, so exact affected package/component within AIX and VIOS cannot be pinned down beyond the OS version banners (AIX 7.2, 7.3; VIOS 4.1); the specific service or setuid path responsible is not disclosed in the available data.
Know when Aix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Kept AV:N/AC:L per source, but CWE-269 improper privilege management typically requires an existing account, so PR:L is more defensible than PR:N; impact remains full C/I/A.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper privilege management.
Executive ViewAI
CVE-2026-17145 is a critical remote code execution vulnerability affecting IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 infrastructure with a 9.8 CVSS score. Attackers can execute arbitrary code on affected Power Systems across your enterprise, potentially compromising applications, data integrity, and business operations. Immediate action is required to identify and contain affected systems.
No vendor-released patch identified at time of analysis. Implement: strict network segmentation isolating affected AIX and PowerVM VIOS systems from untrusted networks; disable unnecessary network services; monitor system and network logs for anomalous activity; apply principle of least privilege to system access; establish dedicated monitoring for exploitation attempts; maintain offline backups of critical systems; develop and test incident response procedures specific to Power infrastructure compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Exploit-DB