IBM AIX EUVD-2026-63750

Exploitation requires a local operating system account within a client LPAR running IBM AIX 7.2 or 7.3, with at minimum low-privilege (standard user) access - confirmed by the CVSS PR:L metric. The vSCSI initiator driver must be active, which is the default and expected configuration in any PowerVM environment where virtual storage resources are provided through VIOS; no non-default feature flag or special configuration is required beyond a standard PowerVM deployment. Remote unauthenticated attackers cannot directly trigger this vulnerability - initial local LPAR access is a hard prerequisite. Exploitation is further limited by the non-automatable SSVC classification, meaning scripted mass exploitation across targets is not feasible without per-target access. The scope change to VIOS adds risk only in environments where the compromised LPAR shares VIOS storage virtualization with other workloads.

The CVSS 8.8 score is driven primarily by the changed scope and full C/I/A triad, which accurately represents the cross-boundary risk in PowerVM multi-tenant deployments. However, the EPSS score of 0.17% at the 7th percentile signals that near-term opportunistic exploitation is unlikely, and CISA's SSVC evaluation classifies exploitation as currently 'none' - consistent with the absence of KEV listing and no identified POC. SSVC's 'Automatable: no' rating confirms that the local access prerequisite prevents mass exploitation, making this primarily an insider threat or post-compromise escalation vector rather than an internet-facing risk. The tension worth noting: CVSS rates this 8.8 and SSVC rates technical impact as 'total,' while EPSS and KEV absence suggest actual exploitation is rare - this divergence is expected for a local privilege escalation in a niche enterprise OS, and does not diminish the urgency for organizations actively running IBM AIX on PowerVM. For multi-tenant LPAR environments in sectors like financial services or government that rely on VIOS for storage virtualization, the isolation boundary violation potential elevates this beyond typical local-only kernel flaws. The non-automated, local-access requirement means the risk is concentrated in environments with shared or poorly segmented LPAR access rather than broadly across all AIX deployments.

An attacker with a low-privilege local account on a client LPAR running IBM AIX 7.2 or 7.3 crafts malformed vSCSI protocol data that causes the AIX kernel's vSCSI initiator driver to dereference an attacker-influenced pointer, triggering kernel memory corruption within the LPAR. Leveraging that corruption, the attacker escalates to kernel-level execution within the client LPAR. From this position, the attacker may attempt to cross the LPAR isolation boundary by abusing the VIOS communication channel, potentially compromising the VIOS server and thereby gaining influence over other LPARs sharing the same physical IBM POWER host. No public proof-of-concept exploit code has been identified at time of analysis.