EUVD-2026-62520
GHSA-44j6-ff62-j2vq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-accessible unauthenticated DoS with no user interaction; impact is availability-only with unchanged scope, directly consistent with the uncontrolled resource consumption description.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
AnalysisAI
Remote denial-of-service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables an unauthenticated network attacker to exhaust system resources and crash or severely degrade affected hosts. The root cause is uncontrolled resource consumption (CWE-400), exploitable without authentication or user interaction via a network-accessible service. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch addressed in advisory node/7283858.
Technical ContextAI
IBM AIX is an enterprise-grade Unix operating system running on IBM Power hardware; IBM PowerVM VIOS (Virtual I/O Server) is the virtualization layer providing I/O services to logical partitions (LPARs) on Power Systems. The root cause is CWE-400 (Uncontrolled Resource Consumption), where attacker-controlled network input causes the affected component to allocate resources - memory, CPU cycles, or connection table entries - without adequate bounds checking or rate limiting, eventually exhausting available capacity. CPE strings confirm scope across both the OS layer (cpe:2.3:a:ibm:aix:*:*:*:*:*:*:*:*) covering AIX 7.2 and 7.3, and the hypervisor I/O layer (cpe:2.3:a:ibm:powervm_vios:*:*:*:*:*:*:*:*) at VIOS 4.1, meaning both the host OS and its virtualization stack are simultaneously exposed. The specific vulnerable network service or protocol is not named in the available data.
RemediationAI
A vendor-released patch is available from IBM; organizations should consult the advisory at https://www.ibm.com/support/pages/node/7283858 for exact fix versions, applicable maintenance levels, and installation procedures. The exact patched version number was not independently confirmed from the provided data and must be obtained directly from the advisory. If immediate patching is not feasible, restrict inbound network access to AIX and VIOS management and service interfaces using perimeter controls or host-based firewall rules, allowing only trusted source IP ranges. For VIOS specifically, note that broad network restrictions may disrupt I/O operations for dependent LPARs - any compensating control should be validated in a non-production environment before production deployment. Network segmentation is a meaningful interim control but does not eliminate risk if the vulnerable service is required for normal operations.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today