IBM AIX EUVD-2026-63735

Remote network access to a service on IBM AIX 7.2, AIX 7.3, or IBM PowerVM VIOS 4.1 that processes user-supplied pathname input is required. The CVSS vector PR:N confirms no authentication is required, and UI:N means no user interaction is needed, but the AC:H rating is the critical limiting factor: exploitation is not straightforward and requires meeting specific, undisclosed environmental or request-structure conditions before the path traversal succeeds. The exact service, daemon, endpoint, or feature that accepts the traversable path input is not identified in available intelligence - this information is essential for defenders and should be obtained from the IBM advisory at https://www.ibm.com/support/pages/node/7283858. Scope is unchanged (S:U), confining the impact to the vulnerable component and preventing this flaw alone from pivoting into other systems. The high complexity requirement substantially limits the viability of automated or mass-exploitation campaigns.

The CVSS 3.1 base score of 4.8 (Medium) reflects network reachability (AV:N) substantially offset by high attack complexity (AC:H) and limited combined impact (C:L/I:L/A:N). The AC:H designation is a meaningful dampener: it signals that exploitation is not straightforward and likely requires precise knowledge of the target's configuration, a specific service state, or a race-condition-like timing requirement. No EPSS probability score was provided in the available intelligence, and the vulnerability does not appear in the CISA KEV catalog; no proof-of-concept code has been publicly identified at time of analysis. Real-world priority is therefore moderate but not negligible: IBM AIX and PowerVM VIOS underpin mission-critical workloads in financial services, government, and industrial control environments, where even limited confidentiality and integrity impact against unpatched, network-exposed systems carries operational consequences. The absence of SSVC input data limits a full framework-based decision, but the AC:H rating suggests this flaw is not easily automatable or suitable for large-scale scanning campaigns. Organizations running AIX 7.2/7.3 or VIOS 4.1 with any network-exposed services that process path input should consult the IBM advisory and apply available fixes, as CWE-22 vulnerabilities are frequently chainable with other weaknesses to escalate impact beyond the base score.

A remote attacker without credentials identifies a network-accessible IBM AIX or VIOS service that processes user-supplied path input. The attacker crafts a request containing path traversal sequences designed to satisfy the high-complexity exploitation condition - potentially requiring specific headers, a particular service state, or precise request timing - causing the service to resolve a path outside its intended restricted directory. This allows the attacker to read sensitive configuration files or credentials, or potentially write data to unauthorized filesystem locations.