EUVD-2026-62426
GHSA-wqph-4x75-jq3m
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable NIM needs only low-privilege auth (PR:L) and no user interaction; unsanitized command execution runs at root-level NIM privilege, breaking out of the component (S:C) with full C/I/A loss.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
AnalysisAI
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands through the Network Installation Manager (NIM) component. Because NIM typically operates with high (often root-level) privilege and the CVSS scope is Changed, successful exploitation can compromise the underlying operating system with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the 9.9 base score and low attack complexity make it a high-priority patch for IBM Power estates.
Technical ContextAI
The flaw is a CWE-78 improper neutralization of special elements used in an OS command (OS command injection) within IBM's Network Installation Manager (NIM), the framework AIX and VIOS use to install, update, and manage systems over the network. NIM master/client operations frequently execute shell commands built from supplied parameters while running as a privileged user; when attacker-controlled input is not sanitized, injected shell metacharacters are passed to the OS command interpreter. The affected platforms per the CPE data are cpe:2.3:a:ibm:aix (7.2 and 7.3) and cpe:2.3:a:ibm:powervm_vios (4.1), i.e. IBM's proprietary Unix for Power Systems and the Virtual I/O Server that virtualizes I/O for LPARs.
RemediationAI
Patch available per vendor advisory: apply the fixes referenced in IBM's advisory at https://www.ibm.com/support/pages/node/7283858 for the affected AIX 7.2/7.3 and PowerVM VIOS 4.1 filesets (the input does not include an exact fix version/APAR, so pull the precise fileset level from that advisory). Until patched, reduce exposure by restricting network reachability of the NIM service to trusted management hosts only (firewall/ACL the NIM master and client ports so untrusted or general-user networks cannot reach it), tightening which accounts hold the low-privilege access that the PR:L vector requires, and monitoring NIM operations for anomalous command execution; the trade-off of network-restricting NIM is that legitimate remote installs/updates from non-management subnets will break and must be run from the allowed hosts.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
IBM AIX 7.2 and 7.3 nimesis NIM master service could allow a remote attacker to execute arbitrary commands due to improp
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today