EUVD-2026-63643
GHSA-xc9p-mj64-29x8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network-facing AIX/VIOS service
-
DeliverySend crafted request to kernel handler
-
ExploitTrigger kernel heap over-read
-
ExecutionLeak adjacent kernel memory
-
ImpactCrash kernel for denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are required beyond network reachability - remote unauthenticated exploitation is possible against affected IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 systems with no user interaction. The primary limiting factors are network exposure of the vulnerable kernel service (an attacker must be able to reach it) and version scope: only AIX 7.2, AIX 7.3, and VIOS 4.1 are listed as affected. The description does not specify the exact protocol or daemon that receives the malicious input, so defenders should confirm which listening service constitutes the attack surface via IBM's advisory. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) describes a remote, low-complexity, unauthenticated attack with no user interaction, which drives the 9.1 base score through high confidentiality and availability impact. Countervailing this, the EPSS score is low at 0.34% (27th percentile), the vulnerability is not on the CISA KEV list, and no public exploit code has been identified - so despite the high CVSS, there is no current evidence of active or widespread exploitation, suggesting priority patching without emergency-incident urgency. Any operator running internet- or network-reachable AIX or VIOS instances should nonetheless treat a remotely triggerable, unauthenticated kernel memory-disclosure-plus-DoS as a high-priority fix, since the barrier to exploitation is low if reliable exploit code emerges. One caution: the description does not name the specific network service or protocol that carries the malicious input, so the exact remote entry point should be confirmed against IBM's advisory before scoping exposure. |
| Exploit ScenarioDerived | A remote attacker with network access to an unpatched AIX or VIOS host sends crafted input to the affected kernel-facing service, triggering the heap over-read; the response leaks adjacent kernel heap memory that may contain sensitive runtime data. By repeating or malforming the request, the same attacker can drive the out-of-bounds access into unmapped memory and crash the system, causing denial of service. No public proof-of-concept is known at time of analysis, so exploitation would require the attacker to develop their own trigger. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 25, 2026
Information disclosure and denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 arise from a kernel heap over-read that a remote attacker can trigger without authentication or user interaction. Successful exploitation leaks sensitive kernel memory contents and can crash the affected system, and the CVSS 9.1 rating reflects the combined high confidentiality and availability impact. No public exploit has been identified at time of analysis, and the EPSS probability is low (0.34%).
Earlier versions of this analysis (1)
Kernel heap over-read in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 exposes sensitive kernel memory and enables denial of service against adjacent-network unauthenticated attackers. The dual impact - high confidentiality breach via kernel heap data leakage and high availability loss via potential kernel crash - yields a CVSS 8.1. No public exploit code or CISA KEV listing has been identified at time of analysis; patch is available from IBM.
RemediationAI
Apply the vendor fix documented in IBM's advisory at https://www.ibm.com/support/pages/node/7283858, which is confirmed available from the vendor; consult that page for the exact iFix/APAR level applicable to your AIX 7.2, AIX 7.3, or PowerVM VIOS 4.1 release, as the input data does not enumerate a specific patched build number. Until the fix is installed, reduce exposure by restricting network reachability of the affected hosts - place AIX and VIOS management and service interfaces behind firewall rules or management VLANs so that only trusted administrative networks can reach them, accepting that this may complicate legitimate remote management. Because the precise vulnerable service is not identified in the available data, IBM's advisory should be reviewed to determine whether a specific port or daemon can be disabled or filtered as a targeted workaround.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a kernel heap over-read, a classic CWE-200 (Exposure of Sensitive Information) condition caused by reading past the bounds of a heap-allocated buffer in the operating-system kernel. The affected components are IBM's AIX UNIX operating system (cpe:2.3:a:ibm:aix) and the PowerVM Virtual I/O Server (cpe:2.3:a:ibm:powervm_vios), both running on IBM Power hardware. Because the over-read occurs in kernel space, the data returned to the attacker may include adjacent heap contents such as pointers, credentials, or other privileged runtime state, and an out-of-bounds access that touches unmapped memory can also fault and destabilize the kernel, producing the denial-of-service outcome.
Know when Aix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Remote unauthenticated network trigger with no user interaction (AV:N/AC:L/PR:N/UI:N); high confidentiality from kernel memory leak and high availability from crash, no integrity impact.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information and cause a denial of service due to a kernel heap over-read.
Executive ViewAI
IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 contain a critical remote vulnerability (CVE-2026-17060, CVSS 9.1) that permits unauthenticated kernel heap over-reads, leading to sensitive data exposure and system denial of service. No public exploit has been identified, but the attack requires no authentication or user interaction, making affected systems vulnerable to opportunistic exploitation. A vendor patch is available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Exploit-DB