IBM AIX EUVD-2026-63385

The attacker must hold an existing low-privileged authenticated local account on a vulnerable IBM AIX 7.2/7.3 or PowerVM VIOS 4.1 system, confirmed by AV:L and PR:L in the CVSS vector. No network-reachable attack surface, no user interaction, and no non-default configuration are described as prerequisites. Exploitation is bounded entirely to the local access requirement: in AIX or VIOS environments where interactive shell access is restricted exclusively to trusted system administrators, there is no attack surface for untrusted actors. The SSVC assessment confirms the attack is not automatable, requiring deliberate manual action. The primary limiting factor is obtaining the initial local account, which gates all further exploitation.

The CVSS 7.8 High score is well-calibrated: AV:L constrains this to systems where the attacker already holds a local account, while AC:L and PR:L indicate no special conditions beyond that baseline are required. EPSS at 0.13% (3rd percentile) is very low, and SSVC confirms exploitation status as none with the attack not automatable - meaning mass exploitation or opportunistic scanning is not a realistic threat vector. However, SSVC's technical impact rating of total is the critical counterweight: any successful exploitation yields full system compromise. The dominant risk scenario is insider threat or lateral movement following initial access in IBM Power environments such as financial services, telecommunications, or government infrastructure. In environments where AIX and VIOS access is restricted exclusively to trusted administrators, the practical attack surface is near-zero. The low EPSS and absence of KEV listing suggest this is not being actively targeted at scale, but the low complexity means the barrier for a motivated attacker with local access is low once the specific authorization bypass is understood.

A low-privileged user with an existing shell account on an IBM AIX 7.3 or PowerVM VIOS 4.1 system invokes a privileged system interface or binary that improperly validates the caller's authorization level. The authorization check is bypassed, granting the unprivileged user root or equivalent elevated access. No public exploit has been identified at time of analysis, but AC:L indicates exploitation would be straightforward once the specific code path is identified, requiring no brute force or race conditions.