EUVD-2026-62719
GHSA-qfxr-9rrq-8wrc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable DoS with no authentication, complexity, or interaction required; impact is availability-only with no scope change to other systems.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
AnalysisAI
Denial of service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 allows unauthenticated remote attackers to exhaust system resources and render affected systems unavailable by sending crafted network input that triggers uncontrolled resource consumption (CWE-400). The CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms low-complexity, unauthenticated remote exploitability with a high availability impact. No active exploitation has been confirmed in CISA KEV, and no public exploit code is known at time of analysis; a vendor patch is available via IBM's support portal.
Technical ContextAI
IBM AIX is a production-grade Unix operating system designed for IBM Power hardware, and PowerVM VIOS (Virtual I/O Server) is an AIX-based specialized partition that arbitrates storage and network I/O for all dependent logical partitions (LPARs) in a PowerVM virtualization environment. CWE-400 (Uncontrolled Resource Consumption) indicates the software fails to impose adequate limits on resource allocation when processing external network input - commonly affecting memory pools, file descriptors, connection queues, or CPU cycles. The affected CPE strings cpe:2.3:a:ibm:aix and cpe:2.3:a:ibm:powervm_vios cover all sub-versions within the named major releases. The specific network service, protocol, or resource type that is exhausted is not disclosed in available data; this technical detail is inferred from the CWE-400 classification and AV:N attack vector alone.
RemediationAI
A vendor-released patch is available from IBM; consult the advisory at https://www.ibm.com/support/pages/node/7283858 for the specific fix package (APARs/PTFs) applicable to AIX 7.2, 7.3, and PowerVM VIOS 4.1. The exact patched version or PTF number is not confirmed in the available intelligence beyond 'patch available from vendor.' Prior to patching, organizations should restrict network access to IBM AIX and PowerVM VIOS management interfaces using host-based IP filtering (ipfilter) or upstream firewall rules, limiting inbound connections to trusted management subnets only; this mitigates remote exploitation but does not address insider or east-west threat paths. Note that VIOS patching typically requires live partition migration (DLPAR) of dependent guest LPARs to an alternate VIOS before applying fixes, necessitating a coordinated maintenance window. No workaround that eliminates the vulnerability without patching is confirmed in available data.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today