EUVD-2026-62752
GHSA-f7gm-qc6x-vp7j
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:A confirmed by adjacent-only reachability; PR:N per CVSS input and unauthenticated description; full C/I/A impact consistent with arbitrary OS command execution.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to command injection.
AnalysisAI
Command injection in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables an unauthenticated attacker with adjacent network access to execute arbitrary OS commands, achieving full compromise of confidentiality, integrity, and availability. The adjacent-network attack vector (AV:A) limits exposure to attackers already positioned on the same local network or VLAN as the affected system, which is a meaningful constraint in typical enterprise deployments of these platforms. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis; IBM has released a patch via its support portal.
Technical ContextAI
CWE-78 (Improper Neutralization of Special Elements used in an OS Command) describes the root cause: user-controllable input is incorporated into an OS-level command without adequate sanitization, allowing injection of additional shell metacharacters or command separators. IBM AIX is IBM's proprietary UNIX-based operating system running on POWER hardware, while IBM PowerVM VIOS (Virtual I/O Server) is a specialized AIX-based partition providing virtualized I/O resources to other logical partitions (LPARs) in a PowerVM hypervisor environment. CPE data confirms both product families are affected: cpe:2.3:a:ibm:aix:*:*:*:*:*:*:*:* and cpe:2.3:a:ibm:powervm_vios:*:*:*:*:*:*:*:*. The affected service or daemon reachable over the adjacent network has not been explicitly identified in available data, but the impact across C/H/I:H/A:H suggests root-level or system-level execution is achievable.
RemediationAI
Apply the vendor-released patch by consulting IBM's support advisory at https://www.ibm.com/support/pages/node/7283858, which details the specific fix packages for AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1. No exact patched version number is independently confirmed from the available reference data - verify the precise fileset or Technology Level (TL)/Service Pack (SP) level directly against the IBM advisory before deployment. As a compensating control prior to patching, restrict adjacent network access to the affected service by applying host-based firewall rules (ipfilter on AIX) or network ACLs to limit which hosts can reach the vulnerable interface; note that this does not eliminate the vulnerability and may impair legitimate management workflows. For PowerVM VIOS specifically, prioritize patching given its role as a shared I/O provider - a compromised VIOS affects all dependent LPARs.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today