EUVD-2026-62528
GHSA-q7gg-4qqf-fxw7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable, unauthenticated resource exhaustion with no confidentiality or integrity impact; only high availability loss.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
AnalysisAI
Uncontrolled resource consumption in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 exposes these systems to remote denial-of-service attacks requiring no authentication or user interaction. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms any network-reachable attacker can trigger availability loss without special privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and a vendor patch is available.
Technical ContextAI
IBM AIX is a Unix-based enterprise operating system designed for IBM Power Systems hardware, and PowerVM VIOS (Virtual I/O Server) is the virtualization layer managing I/O resources for logical partitions on those systems. CWE-400 (Uncontrolled Resource Consumption) identifies the root cause: the affected component fails to impose adequate limits on resource usage - such as memory, CPU cycles, file descriptors, or network connection slots - when processing remote input, allowing an attacker to exhaust available resources. The CPE entries cpe:2.3:a:ibm:aix:*:*:*:*:*:*:*:* and cpe:2.3:a:ibm:powervm_vios:*:*:*:*:*:*:*:* use wildcards, indicating the flaw spans all sub-versions of both AIX 7.2/7.3 and PowerVM VIOS 4.1 without further narrowing from available data. The co-presence of both AIX and VIOS in the advisory suggests the vulnerable network service may be a shared or exposed component common to both environments.
RemediationAI
Apply the vendor-released patch documented in the IBM Security Advisory at https://www.ibm.com/support/pages/node/7283858. The exact patched version or Technology Level for AIX 7.2, 7.3, and PowerVM VIOS 4.1 is not independently confirmed from available data - the IBM advisory is the authoritative source for fix-level specifics. As a compensating control prior to patching, restrict network access to IBM AIX and VIOS management interfaces using perimeter firewalls or host-based access control lists, allowing only trusted source IP ranges to reach the affected service. Applying rate-limiting on inbound connections at the network edge may also reduce the effectiveness of resource-exhaustion attempts, though it does not eliminate the underlying vulnerability. Note that excessive network restriction in PowerVM environments may disrupt I/O operations for dependent logical partitions, so changes should be tested in non-production environments first.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today