EUVD-2026-62424
GHSA-6hh6-56f7-7gvq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Private key is in a publicly downloadable file (AV:N/AC:L/PR:N/UI:N); a forged-trust key yields high confidentiality and integrity impact but no availability impact.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass security restrictions due to the exposure of intermediate certificate authority private keys in a publicly available update file.
AnalysisAI
Sensitive-key exposure in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 Network Installation Management (NIM) leaks intermediate certificate authority (CA) private keys inside a publicly downloadable update file, letting remote attackers forge trusted certificates and bypass security restrictions. Rated CVSS 9.1, the flaw impacts confidentiality and integrity (C:H/I:H) but not availability, and IBM has released a fix. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the ease of obtaining a live CA key makes this a high-priority credential-hygiene issue.
Technical ContextAI
NIM (Network Installation Management) is IBM's framework for remotely installing, updating, and managing AIX and VIOS across networked Power Systems servers, and it relies on PKI/TLS trust to authenticate update and management traffic. The root cause is CWE-312 (Cleartext Storage of Sensitive Information): private keys belonging to an intermediate CA in the trust chain were bundled into an update file that IBM published for download, so anyone retrieving that file also obtains the signing key. Possession of an intermediate CA private key allows an attacker to mint certificates that chain to a trusted root, undermining any authentication or channel-integrity control that depends on that CA. Affected products per CPE are cpe:2.3:a:ibm:aix and cpe:2.3:a:ibm:powervm_vios.
RemediationAI
Patch available per vendor advisory - apply the IBM-provided fix/ifix for AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1 NIM as documented at https://www.ibm.com/support/pages/node/7283858, using the exact fixed levels IBM lists there (specific fix version not present in the supplied data, so do not assume a build number). Because this is an exposed-key issue, patching the update file alone is insufficient: rotate and revoke the affected intermediate CA and reissue any certificates that chained to it, then redistribute the new trust anchor to NIM clients. As compensating controls until keys are rotated, restrict NIM network exposure by limiting NIM master/client traffic to trusted management VLANs and blocking external access to the NIM service, and monitor for certificates issued by the compromised intermediate CA; the trade-off is that network segmentation may disrupt automated installs and certificate revocation can break clients still trusting the old chain.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today