IBM AIX EUVD-2026-63618

Exploitation requires authenticated local access with at minimum a low-privilege user account, as confirmed by the CVSS vector (AV:L/PR:L). The attacker must have filesystem write access to a directory where a symbolic link can be planted in a location reachable by a process running with elevated privileges. No remote or unauthenticated exploitation path exists - the attack vector is strictly local. SSVC 'Automatable: no' confirms the absence of a mechanism for remote or scripted mass exploitation. The specific privileged process or SUID binary responsible for the improper symlink resolution is not identified in available sources; defenders should assume any AIX or VIOS system utility performing file operations on user-influenced paths may be involved. Exploitation is further constrained by the need to predict or influence when the privileged process accesses the target path, which may introduce timing complexity not captured by CVSS AC:L.

The CVSS 7.8 High vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly captures the full post-exploitation impact but is bounded by the local attack vector, meaning an adversary must already hold authenticated shell access before this flaw can be leveraged - it cannot be triggered remotely. EPSS at 0.17% (7th percentile) is very low, and the SSVC assessment of exploitation status 'none' and 'Automatable: no' confirm that no observed exploit activity or mass-exploitation pathway exists at time of analysis. Despite SSVC's 'Technical Impact: total' designation, which reflects the root-level access achievable, the practical urgency is moderate rather than critical: threat actors must already have a foothold on the target system. Risk is elevated in multi-tenant or shared environments where IBM Power systems run multiple logical partitions or where VIOS is accessible to a broader set of local user accounts, as successful exploitation could cascade to affect hosted virtual machines. For tightly access-controlled dedicated systems, the realistic exploitation window is narrow.

A low-privileged local user on an IBM AIX 7.2/7.3 or PowerVM VIOS 4.1 system creates a malicious symbolic link in a world-writable or user-accessible directory, redirecting it to a sensitive system file or privileged path. When a SUID binary, system daemon, or VIOS management process subsequently accesses that path without validating the symlink target, it operates on the attacker-controlled destination, enabling the attacker to read sensitive files, overwrite privileged content, or gain root-level code execution. No public exploit code exists at time of analysis, requiring manual crafting of the symlink attack by the adversary.