EUVD-2026-63751
GHSA-5x8c-w6hj-rjr7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify UDP RPC port reachable on target
-
DeliverySend single crafted malformed UDP packet
-
ExploitRPC service triggers uncontrolled resource consumption
-
ExecutionFault propagates to kernel/partition level
-
PersistLPAR becomes completely unavailable
-
ImpactOperator must restart LPAR to restore service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The RPC service must be reachable over UDP from the attacker's network position - this is the sole prerequisite. No authentication is required (CVSS PR:N confirmed). No special configuration, enabled feature, or elevated privilege is needed on the attacker side. Exploitation is constrained by network reachability: systems behind firewalls that block UDP to RPC ports (UDP 111 and dynamic RPC ports) are not exposed. The vulnerability is limited to availability impact; exploitation cannot yield code execution, credential access, or data exfiltration based on available data. Affected platforms are IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 specifically - other IBM operating systems or POWER firmware are not indicated as affected. |
| Impact | The CVSS 7.5 score and vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflect the risk profile: network-reachable, zero authentication, low complexity, and full availability impact. No EPSS data was provided in the source intelligence, so exploitation probability cannot be quantified. There is no CISA KEV listing and no known public exploit code, which moderates immediacy. The scope is limited to denial of service - confidentiality and integrity are unaffected, which narrows the worst-case scenario but does not diminish the operational severity of an LPAR restart in production. IBM AIX and PowerVM VIOS typically underpin mission-critical enterprise workloads (ERP, databases, financial systems); even a brief unplanned outage carries significant business impact. The absence of any authentication or configuration prerequisite means any host with UDP reachability to the RPC port is directly exposed - network segmentation is the primary compensating control. |
| Exploit ScenarioDerived | An attacker with UDP connectivity to the target system - for example, from an internet-exposed segment or a compromised internal host - sends a single crafted UDP datagram to the RPC portmapper or a registered RPC service. The malformed packet triggers uncontrolled resource consumption in the RPC handler, cascading into a system-wide fault that renders the LPAR completely unresponsive. All workloads on the affected partition are interrupted until an operator performs an LPAR restart. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
Remote denial-of-service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows an unauthenticated network attacker to crash affected systems by sending a crafted UDP packet to the RPC service. The attack requires no credentials or user interaction and results in complete system unavailability, demanding an LPAR restart to recover - a non-trivial operational impact for enterprise environments running critical POWER-based workloads. No public exploit code has been identified at time of analysis, but the trivially low attack complexity against a zero-authentication network service elevates practical risk.
RemediationAI
Consult the IBM advisory at https://www.ibm.com/support/pages/node/7283858 for official APARs and Technology Level fixes; specific patched versions are not independently confirmed from the available data. As an immediate compensating control, restrict UDP access to RPC service ports (typically portmapper on UDP 111 and dynamically assigned RPC ports) at the network perimeter and host-based firewall, permitting only trusted source addresses. Blocking unrestricted UDP to RPC eliminates the remote unauthenticated attack surface but may disrupt NFS, NIS, or other RPC-dependent services - assess dependencies before applying. Where VIOS is concerned, ensure management interfaces are isolated to dedicated management VLANs not reachable from untrusted segments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM AIX is a Unix-based operating system running on IBM POWER architecture hardware; PowerVM VIOS (Virtual I/O Server) is the specialized partition within PowerVM environments that brokers I/O resources for logical partitions (LPARs). The affected component is the RPC (Remote Procedure Call) service, which listens over UDP. CWE-400 (Uncontrolled Resource Consumption) identifies the root cause: the RPC service fails to properly validate or bound resource usage when processing a malformed UDP datagram, allowing an attacker to exhaust system resources or trigger a fatal fault. Because UDP is connectionless and stateless, spoofing and amplification are feasible without a handshake. The LPAR restart requirement indicates the fault propagates beyond a process crash to the partition level, consistent with a kernel-space or privileged service failure.
Know when Aix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
UDP RPC service is network-exposed, requires no authentication or interaction; impact is solely availability loss with no confidentiality or integrity consequence.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 allows a remote unauthenticated attacker can send a crafted UDP packet to a reachable RPC service, resulting in complete system unavailability and requiring an LPAR restart.
Executive ViewAI
IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 systems are vulnerable to remote denial-of-service attacks that crash production infrastructure without requiring authentication or user interaction. Affected organizations face operational disruption requiring manual LPAR restarts to restore service. With no vendor patch available and trivially simple attack mechanics, any exposed POWER infrastructure presents immediate availability risk to business-critical workloads.
No vendor-released patch identified at time of analysis. Interim mitigations include network segmentation restricting access to RPC services, firewall rules limiting UDP traffic to the RPC service port, disabling RPC services if not operationally required, and placing affected systems behind VPN or bastion host access controls to limit exposure to trusted networks only.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Exploit-DB