IBM AIX CVE-2026-19449

Exploitation requires an active, authenticated local session on the affected system with at minimum a standard unprivileged user account - confirmed by CVSS PR:L and AV:L. The attacker must be able to invoke the cmdnim binary, which is part of IBM NIM and present on AIX systems where NIM is installed. No non-default configuration or special feature enablement is described as required. Exploitation is strictly bounded by the need for prior local access: network-based unauthenticated exploitation is not possible per AV:L. The key limiting factor for defenders is controlling who holds local shell access to IBM AIX and VIOS systems; the absence of any authentication or interaction barrier beyond that initial foothold means privilege escalation follows immediately. On PowerVM VIOS systems, root access may additionally threaten guest virtual machine isolation.

The CVSS 8.8 High score is driven by S:C (scope change to root) combined with full C:H/I:H/A:H impact, despite the local-only attack vector (AV:L). This means the raw score overstates remote risk - the attack is not network-reachable and requires at minimum an unprivileged local account (PR:L). AC:L confirms no special timing, race conditions, or complex prerequisites are needed beyond that account. No EPSS score was provided, preventing probabilistic exploitation forecasting. The CVE is not in CISA KEV, and no POC has been identified, suggesting exploitation has not yet been publicly demonstrated or observed at scale. However, for organizations with multi-user AIX systems or where initial access is achievable (e.g., compromised SSH credentials, insider threat, or lateral movement from another system), this becomes a decisive privilege escalation stepping stone with very low operational complexity. PowerVM VIOS instances are particularly sensitive targets since VIOS root access can affect guest virtual machines running on the same hypervisor.

An attacker who has obtained a standard unprivileged local account on an IBM AIX 7.3 or PowerVM VIOS 4.1 system - through credential stuffing against SSH, insider misuse, or lateral movement from a compromised adjacent host - invokes cmdnim with a specially crafted argument or payload targeting the privilege escalation flaw. Due to improper privilege handling in the NIM command framework, the payload executes as root with full system control. No public POC has been identified, but AC:L indicates exploitation would be straightforward once local access is obtained.