IBM AIX EUVD-2026-63634

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are required - remote unauthenticated exploitation is possible against affected IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 systems whose vulnerable network service is reachable by the attacker. The practical limiting factor is network reachability of that service: systems whose management/VIOS interfaces are firewalled to trusted administrative networks are not directly exposed. Additionally, SSVC rates the flaw 'Automatable: no,' suggesting exploitation may require some targeting effort rather than fully automated mass scanning, and only the enumerated versions (AIX 7.2, AIX 7.3, VIOS 4.1) on POWER platforms are affected.

The signals are largely aligned toward high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes trivial, unauthenticated, network-reachable exploitation, and SSVC rates Technical Impact as 'total,' consistent with full RCE. However, the signals also contain tension worth flagging: SSVC marks Exploitation as 'none' and Automatable as 'no,' the EPSS probability is only 0.69% (50th percentile), and there is no KEV listing or public POC - so despite the 9.8 score this is a high-potential but not-yet-actively-exploited issue rather than a confirmed mass-exploitation event. The 'Automatable: no' rating slightly tempers the AC:L reading, implying reconnaissance or targeting effort may be required at scale. Given total technical impact against a foundational OS/virtualization layer, defenders should still treat this as urgent and patch promptly even though real-world exploitation has not yet been observed; the low EPSS despite a critical score points to targeted rather than commodity risk today.

An attacker with network access to an exposed AIX or VIOS management/service interface sends crafted requests that exploit the improper authentication flaw, bypassing credential checks to reach a privileged code path and execute arbitrary code on the host. Because the vector is AV:N/AC:L/PR:N/UI:N, no valid account or user interaction is needed; a successful hit against a VIOS partition could cascade to the guest LPARs depending on it. No public exploit code has been identified at time of analysis.