IBM AIX EUVD-2026-63737

The CVSS vector is AV:N/AC:L/PR:N/UI:N, indicating remote, low-complexity exploitation with no authentication or user interaction; however, the description does not name the exact vulnerable service, so exploitation concretely requires that the affected (unspecified) AIX/VIOS network daemon be reachable from the attacker. The limiting factors are deployment-driven rather than configuration-flag-driven: the target must be running IBM AIX 7.2/7.3 or PowerVM VIOS 4.1 specifically, on POWER hardware, with the vulnerable service network-exposed - VIOS and AIX management/I/O interfaces are commonly confined to segregated HMC/management networks, which meaningfully limits real-world reachability despite the AV:N rating. SSVC also rates the flaw 'Automatable: no', implying reliable mass exploitation is not straightforward.

The signals here are notably split. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, total C/I/A impact) and the SSVC 'total' technical-impact rating both point to a worst-case, unauthenticated, low-complexity remote RCE. However, the exploitation-side signals are all cool: EPSS is only 0.41% (35th percentile), CISA SSVC rates exploitation as 'none' and Automatable as 'no', the CVE is not in CISA KEV, and no public proof-of-concept has been identified. This is a genuinely high-priority patch for anyone running AIX/VIOS - the impact ceiling is maximal and IBM's PSIRT reported it - but the current real-world exploitation risk appears latent rather than active, likely reflecting the niche, high-value nature of POWER-based deployments rather than commodity mass-scanning targets. A conflict worth flagging: the CVSS vector asserts a network attack vector with no privileges, but the description gives no detail on the exposed service, so operators should verify with IBM which port/daemon must be reachable before assuming default internet-facing exposure. SSVC 'Automatable: no' further suggests any exploitation would be targeted and manual rather than wormable.

A remote attacker with network access to the vulnerable AIX/VIOS service sends specially crafted input that overflows a heap buffer, corrupting allocator state to hijack execution and run arbitrary code on the host - no credentials or user interaction are required per the CVSS vector. Because AIX 7.x and VIOS 4.1 underpin POWER virtualization, a successful VIOS compromise could cascade to the I/O paths of hosted LPARs. No public exploit code is identified at time of analysis, so an attacker would need to develop the exploit independently.