EUVD-2026-63719
GHSA-j437-fhrr-26hx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach affected AIX/VIOS service over network
-
DeliverySend crafted overflowing input
-
ExploitTrigger out-of-bounds write (CWE-787)
-
ExecutionCorrupt memory and hijack control flow
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker needs network reachability to the affected component on an IBM AIX 7.2/7.3 or PowerVM VIOS 4.1 host and the ability to send crafted input that triggers the out-of-bounds write; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration is stated as required. The practical limiting factor is exposure of the vulnerable service: AIX and VIOS management/I/O services are frequently on segmented administrative networks rather than the public internet, so reachability - not authentication - is the primary constraint. The exact vulnerable service, port, and protocol are not specified in the available data, which limits precise scoping of where the condition applies. |
| Impact | The signals point strongly toward high real-world risk rather than an inflated score: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with no user interaction, and the CIA impact is High/High/High, yielding 9.8. That said, several corroborating signals are absent - no EPSS probability was provided, there is no KEV listing, and no POC has surfaced, so this is best treated as a high-severity but not-yet-actively-exploited flaw where exploitation is plausible but unproven. Because AIX and VIOS typically run business-critical workloads (banking cores, ERP, virtualization control planes), any organization running affected versions should treat this as urgent and patch on an accelerated cycle even before an exploit appears. The main caveat is that the description is terse and names no affected service; defenders should confirm the exposed component with IBM's advisory before assuming internet-facing reachability, since AIX/VIOS management interfaces are often segmented rather than internet-exposed. |
| Exploit ScenarioDerived | An attacker with network reachability to an affected AIX 7.3 or VIOS 4.1 host sends a crafted request to the vulnerable network service, overflowing a buffer and overwriting adjacent memory to hijack execution. Because no authentication or user interaction is required (PR:N/UI:N), a single unauthenticated packet exchange could yield code execution at the privilege level of the vulnerable service. No public exploit is identified at time of analysis, so this scenario is currently theoretical pending POC development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a remote attacker can trigger to run arbitrary code on affected IBM Power-based Unix systems. The flaw was reported by IBM's own PSIRT and carries a CVSS 9.8 rating reflecting network-reachable, unauthenticated, no-interaction exploitation with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the severity and privileged role of these platforms make it a high-priority patching item.
RemediationAI
Apply IBM's fix as the primary remediation: consult the IBM advisory at https://www.ibm.com/support/pages/node/7283858 and install the vendor-provided iFix or fix pack for your exact AIX 7.2/7.3 or VIOS 4.1 technology level - Patch available per vendor advisory, though an exact patched version string is not included in the provided data and must be taken from IBM's page. Until the fix is applied, reduce exposure by restricting network reachability of AIX/VIOS services: place management and VIOS interfaces on isolated administrative VLANs, enforce host firewall (IPsec filter) rules to permit only trusted administrative hosts, and block the affected service's port at the network perimeter (trade-off: may disrupt remote administration or inter-LPAR I/O paths, so validate against operational dependencies before enforcing). Because the vulnerable component is not named, prioritize identifying which listening service is affected via IBM's advisory so compensating controls can be targeted rather than broadly disruptive.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM AIX is a proprietary Unix operating system that runs on IBM Power (POWER) architecture servers, and PowerVM VIOS (Virtual I/O Server) is the AIX-based appliance layer that virtualizes storage and network I/O for LPARs (logical partitions) on those systems. The vulnerability is classified as CWE-787 (Out-of-bounds Write), meaning a length or bounds check is missing or incorrect and attacker-controlled data is written past the end of an allocated buffer, corrupting adjacent memory. On a network-facing service this class of bug can be steered into control-flow hijacking and arbitrary code execution. The specific vulnerable component, daemon, or protocol is not disclosed in the available description or the single IBM reference, so the exact attack surface (which listening service parses the malformed input) cannot be pinned down from the provided data.
Know when Aix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states remote arbitrary code execution via buffer overflow with no stated auth or interaction, supporting AV:N/AC:L/PR:N/UI:N and full C/I/A impact.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
Executive ViewAI
A critical remote code execution vulnerability in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables unauthenticated remote attackers to execute arbitrary code and gain complete control of enterprise infrastructure systems without user interaction. Organizations running IBM Power-based Unix systems face immediate risk of full system compromise, with no vendor patch available to mitigate the threat.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) network segmentation and access controls limiting inbound connectivity to affected systems to authorized administrative networks only; (2) enhanced logging and real-time alerting to detect exploitation attempts; (3) increased monitoring for indicators of compromise; (4) consideration of system isolation or temporary shutdown if operationally feasible; (5) continuous vendor advisory monitoring to expedite patch deployment upon availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Exploit-DB