Aix
Monthly
Arbitrary command execution against IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 is possible by an unauthenticated attacker on the same network segment who can deliver DHCP option values containing unescaped shell metacharacters to the system's DHCP client. The DHCP client fails to neutralize these metacharacters before passing option data to shell processing (CWE-78), enabling full confidentiality, integrity, and availability compromise of the target host. A vendor patch is available via IBM support, and no public exploit or CISA KEV listing has been identified at time of analysis.
Heap buffer overflow in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 enables unauthenticated adjacent-network attackers to execute arbitrary code on affected systems. The CWE-787 out-of-bounds write flaw carries a CVSS score of 8.8 and yields full confidentiality, integrity, and availability compromise upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis; however, a vendor-supplied patch is available via IBM support advisory node/7283858.
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a heap buffer overflow (CWE-787 out-of-bounds write) in an affected network-facing component. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated, low-complexity network exploitation with full confidentiality, integrity, and availability impact. IBM has published a fix; no public exploit identified at time of analysis and no CISA KEV listing, so this is currently a high-severity but not confirmed-exploited issue.
OS command injection in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables an unauthenticated attacker with adjacent network access to execute arbitrary operating system commands without any user interaction. The flaw (CWE-78) resides in a network-exposed component that fails to neutralize shell metacharacters before incorporating user-supplied input into OS commands, granting full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, but a vendor patch is available via IBM support advisory.
OS command injection in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 allows an adjacent network attacker without credentials to execute arbitrary operating system commands. The flaw (CWE-78) arises from improper neutralization of special elements passed to OS command constructors, exposing the full confidentiality, integrity, and availability of affected hosts. No public exploit or CISA KEV listing has been identified at time of analysis, though a vendor patch is available via IBM Support.
Stack buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables unauthenticated remote code execution by any attacker with adjacent network access. The flaw (CWE-787, Out-of-bounds Write) corrupts stack memory during processing of a crafted network payload, allowing an attacker to overwrite return addresses and redirect execution without requiring credentials or user interaction. No public exploit has been identified at time of analysis and IBM has released a patch, but the AV:A/PR:N/AC:L vector makes this a high-priority fix for any organization running IBM Power Systems infrastructure.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering an out-of-bounds write (CWE-787) in an affected component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates the flaw is reachable over the network by unauthenticated attackers with low complexity, yielding full compromise of confidentiality, integrity, and availability. IBM has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote information disclosure in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from an integer underflow in the kernel's IPv4 IP-options parser (CWE-125 out-of-bounds read), letting a remote attacker leak sensitive memory contents by sending crafted IP packets. IBM (the reporting vendor) rates it CVSS 9.4, and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
TOCTOU race condition in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 permits a local, low-privileged user to overwrite critical system files or extract sensitive information by exploiting the timing gap between a file-check and file-use operation. The attack is constrained to local access with high exploitation complexity, yet the potential impact spans full confidentiality, integrity, and availability compromise of the affected system. No public exploit or CISA KEV listing exists at time of analysis; IBM has released a vendor patch.
Remote denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows unauthenticated network attackers to crash or exhaust resources in the SSL subsystem by omitting an expected client certificate during the TLS handshake. The CVSS 7.5 rating (AV:N/AC:L/PR:N/UI:N) confirms low attack complexity with no authentication required, making exploitation straightforward against any exposed SSL service on affected systems. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the patch is available and should be prioritized for internet-facing AIX and VIOS deployments.
Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables unauthenticated remote attackers to exhaust system resources via network-delivered input, fully disabling availability (CVSS A:H) without any confidentiality or integrity impact. The vulnerability is rooted in CWE-400 uncontrolled resource consumption, triggered from the network with no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N). No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available from IBM.
Denial of service in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker crash or hang the affected system by triggering an integer underflow (CWE-190) in a network-reachable component. The flaw was reported by IBM, which has released a fix; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. Note that IBM's published CVSS 9.8 claims full confidentiality/integrity/availability impact, which conflicts with the description's DoS-only wording.
Denial of service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 allows unauthenticated remote attackers to exhaust system resources and render affected systems unavailable by sending crafted network input that triggers uncontrolled resource consumption (CWE-400). The CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms low-complexity, unauthenticated remote exploitability with a high availability impact. No active exploitation has been confirmed in CISA KEV, and no public exploit code is known at time of analysis; a vendor patch is available via IBM's support portal.
Unbounded recursion in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 exposes these systems to remote denial-of-service attacks requiring no authentication or user interaction. Network-reachable attackers can trigger uncontrolled resource consumption, exhausting stack or memory resources and disrupting availability of affected systems. No public exploit code has been identified and CISA KEV does not list this vulnerability; a vendor-released patch is available via IBM's support portal.
TNC policy server impersonation in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a network-positioned attacker forge the Trusted Network Connect policy server and tamper with the traffic between it and the endpoint, because the client fails to properly validate the server's certificate (CWE-295). An attacker who can intercept the session can present a fraudulent certificate, read limited data and alter integrity-critical policy exchanges. IBM has released a fix; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
IBM AIX 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, expose a time-of-check time-of-use (TOCTOU) race condition that local, unprivileged attackers can exploit to corrupt data integrity or crash the system. The flaw requires only local shell access with no privileges, making it exploitable by any local user account on affected POWER-architecture systems. No public exploit code or CISA KEV listing exists at time of analysis, though a vendor patch is available.
Uncontrolled resource consumption in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 exposes these systems to remote denial-of-service attacks requiring no authentication or user interaction. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms any network-reachable attacker can trigger availability loss without special privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and a vendor patch is available.
IBM AIX 7.2 and 7.3, and PowerVM VIOS 4.1 expose an unauthenticated remote denial-of-service condition rooted in a NULL pointer dereference. A remote attacker with no credentials or user interaction can crash affected network-accessible components, resulting in complete availability loss (A:H) with no confidentiality or integrity impact. No public exploit code or active exploitation has been confirmed at time of analysis, and IBM has released a patch via advisory https://www.ibm.com/support/pages/node/7283858.
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute arbitrary operating-system commands due to improper neutralization of special elements (CWE-78). Rated CVSS 9.9 with a scope change, a successful low-privilege attacker can break out of the application context and run commands on the underlying enterprise Unix host, threatening confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and network reachability make it a high-priority patch.
Heap buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables unauthenticated remote code execution by attackers positioned on an adjacent network segment, with no user interaction required. The flaw (CWE-787, out-of-bounds write) results in full compromise of confidentiality, integrity, and availability of the affected system. A vendor patch has been released via IBM advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote denial-of-service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 is caused by a CWE-787 out-of-bounds write reachable by unauthenticated network attackers with no complexity prerequisites. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects straightforward remote triggering with high availability impact but no confidentiality or integrity consequence. IBM has released a patch via the vendor advisory; no public exploit code has been identified at time of analysis.
Local privilege escalation in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows an authenticated low-privileged user to gain full elevated privileges due to improper privilege management (CWE-269). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that any standard local user account is sufficient to trigger the flaw with low complexity and no user interaction, resulting in complete confidentiality, integrity, and availability compromise of the affected system. No public exploit identified at time of analysis, and a vendor patch is available via IBM advisory.
Remote denial-of-service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables an unauthenticated network attacker to exhaust system resources and crash or severely degrade affected hosts. The root cause is uncontrolled resource consumption (CWE-400), exploitable without authentication or user interaction via a network-accessible service. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch addressed in advisory node/7283858.
Unauthenticated remote access to NFS-exported filesystems is possible in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 due to improper authentication (CWE-287). The CVSS vector AV:N/AC:L/PR:N/UI:N confirms that unauthenticated remote attackers on the network can exploit this with low complexity and no user interaction, gaining high-confidence read access and limited write access to exported filesystem data. No public exploit has been identified at time of analysis, and IBM has released a patch via advisory 7283858.
Remote denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is exploitable by unauthenticated attackers who send malformed client registration packets to the NIM (Network Installation Manager) server, triggering a classic buffer overflow that crashes the nimserver daemon. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms low-complexity, network-accessible exploitation requiring no privileges, though impact is strictly limited to availability - no confidentiality or integrity exposure is present. IBM has released a patch via support advisory 7283858; no public exploit code has been identified and this vulnerability does not appear on the CISA KEV catalog at time of analysis.
Remote privilege escalation to root in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 stems from an improper authentication weakness (CWE-287) that lets an unauthenticated network attacker bypass identity checks and obtain root-level control. The CVSS 9.8 rating reflects a network-reachable, low-complexity flaw requiring no privileges or user interaction, with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the severity and unauthenticated network vector make it a high-priority patching target for IBM Power estates.
Improper TLS certificate validation in the NIM (Network Installation Management) subsystem of IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 enables remote attackers to gain unauthorized access to AIX systems by exploiting the failure to verify certificate authenticity during NIM communications. The CVSS 8.1 High score reflects high confidentiality and integrity impact across a network-exploitable path with low complexity and no user interaction required. No public exploit identified at time of analysis, but the authentication bypass classification of this flaw makes it a meaningful privilege escalation and lateral movement risk in IBM Power environments.
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands through the Network Installation Manager (NIM) component. Because NIM typically operates with high (often root-level) privilege and the CVSS scope is Changed, successful exploitation can compromise the underlying operating system with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the 9.9 base score and low attack complexity make it a high-priority patch for IBM Power estates.
Sensitive-key exposure in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 Network Installation Management (NIM) leaks intermediate certificate authority (CA) private keys inside a publicly downloadable update file, letting remote attackers forge trusted certificates and bypass security restrictions. Rated CVSS 9.1, the flaw impacts confidentiality and integrity (C:H/I:H) but not availability, and IBM has released a fix. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the ease of obtaining a live CA key makes this a high-priority credential-hygiene issue.
Unauthenticated remote file overwrite in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is possible via the nimesis registration service, which fails to sanitize path traversal sequences in client-supplied input. An attacker with network access to the nimesis service can write arbitrary content to locations outside the intended directory, potentially overwriting sensitive system files such as cron jobs, init scripts, or authentication databases. No public exploit or active exploitation has been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is straightforwardly exploitable without authentication.
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, allow local users to gain privileges via vectors involving (1) arp.ib or (2). Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Uncontrolled resource consumption in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a local high-privileged attacker to cause a denial of service by supplying crafted directory records to the vulnerable parsing component. The CVSS vector (AV:L/PR:H) confirms that exploitation is constrained to authenticated local actors with elevated privileges, limiting the realistic threat pool considerably. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Path traversal in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote, unauthenticated attackers to bypass directory-based access controls by supplying manipulated pathname inputs that escape restricted filesystem boundaries. The vulnerability carries a CVSS 3.1 score of 4.8 (Medium) with high attack complexity (AC:H), which constrains opportunistic exploitation while still leaving targeted attacks viable without requiring credentials. No public exploit code or active exploitation has been identified at time of analysis; IBM has published an advisory at their support portal (https://www.ibm.com/support/pages/node/7283858).
Out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables a local, low-privileged attacker to crash the affected system, resulting in a denial of service. The CVSS scope-change metric (S:C) is particularly significant in the PowerVM context: a crash of the VIOS host can simultaneously disrupt I/O services for all co-hosted guest logical partitions (LPARs) sharing that VIOS, amplifying the blast radius well beyond the directly exploited node. No public exploit code and no confirmed active exploitation have been identified at time of analysis.
NULL pointer dereference in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a local low-privileged attacker to crash the system, causing a denial of service. Exploitation requires high attack complexity, suggesting a race condition or specific system state must be induced. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog; a vendor patch is available via IBM support.
Symlink following vulnerability in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 allows a local low-privileged attacker to cause a denial of service - and potentially file corruption - through improper symbolic link validation (CWE-59). The CVSS vector (AV:L/AC:H/PR:L/I:H/A:H) indicates exploitation requires local access, a race-condition timing window, and results in both high integrity and availability impact despite the DoS classification. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; IBM has released a patch.
Kernel memory disclosure in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows a local attacker with standard user privileges to read sensitive out-of-bounds kernel memory via an unspecified vulnerability. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a local shell account with no elevated rights, making it viable for any authenticated local user or a compromised service account. No public exploit code has been identified at time of analysis, and IBM has released a patch via the vendor advisory.
IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 expose sensitive information over the network, enabling remote unauthenticated attackers to intercept in-flight messages and forge replies. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials or user interaction, making any network-adjacent attacker a potential threat. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; IBM has released a patch.
Uncontrolled resource consumption in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1, enables a local low-privileged attacker to exhaust system resources and trigger a denial of service condition. The vulnerability is classified under CWE-400 and carries a CVSS 3.1 base score of 5.5 with a local attack vector requiring low privileges. IBM has released a patch via advisory 7283858; no active exploitation or public proof-of-concept code has been identified at time of analysis.
Heap-based buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables a local authenticated attacker with high privileges to execute arbitrary code on affected systems. The vulnerability is rooted in improper memory management (CWE-787) and carries a CVSS 3.1 score of 6.7, reflecting the local access requirement and elevated privilege prerequisite that constrain real-world exploitability. IBM has released a patch via its support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables a local, high-privileged attacker to execute arbitrary code. The vulnerability is rooted in a memory corruption flaw (CWE-787) that can corrupt adjacent memory regions during a write operation. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Local denial-of-service in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows a high-privileged local attacker to crash the system via an out-of-bounds write condition. The attack is constrained to local access with elevated privileges (PR:H per CVSS), limiting the practical blast radius primarily to insider threats or post-compromise scenarios. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in a lower-urgency triage category despite the severity of the availability impact.
Out-of-bounds memory read in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a local authenticated attacker to disclose sensitive information from adjacent memory regions. The flaw is constrained entirely to local access with low privileges, yielding a CVSS score of 3.3 (Low), and poses greatest risk in shared or multi-tenant Power Systems environments where untrusted users hold shell access. No public exploit code or active exploitation has been identified at time of analysis.
Integer overflow in IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1 allows a local attacker with limited privileges to extract sensitive information or trigger a denial of service under specific high-complexity conditions. Rooted in CWE-190 (Integer Overflow or Wraparound), the vulnerability carries a CVSS 3.1 base score of 3.6 (Low), reflecting the mandatory local access requirement and elevated attack complexity. No public exploit code or active exploitation has been identified at the time of analysis.
Denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 is achievable by an unauthenticated adjacent-network attacker exploiting an out-of-bounds write (CWE-787) in a network-accessible component. Successful exploitation crashes or degrades the target system without impacting confidentiality or data integrity. No public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 exposes sensitive files to remote, unauthenticated attackers over the network. The flaw (CWE-22) allows directory traversal sequences to escape an intended path boundary, enabling read access to files that should not be externally accessible. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Out-of-bounds memory read in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 exposes sensitive system memory to locally authenticated users holding low-privilege accounts. The flaw (CWE-125) allows an attacker with existing local access to read memory contents beyond intended buffer boundaries, producing high confidentiality impact while leaving system integrity and availability unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via advisory 7283858.
Out-of-bounds read (CWE-125) in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 exposes a remotely reachable attack surface that allows unauthenticated network attackers to cause a denial of service under high-complexity conditions. The CVSS vector also records a limited integrity impact (I:L), which is inconsistent with the description's exclusive mention of denial of service and warrants verification against the vendor advisory. No public exploit code or active exploitation has been identified; a vendor patch is available from IBM.
Heap buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables a local low-privileged attacker to crash the system, resulting in a denial of service. The flaw is rooted in improper bounds checking during heap memory operations (CWE-787). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, a vendor-released patch is available via IBM advisory node/7283858.
Denial of service in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 is achievable by unauthenticated remote attackers positioned on an adjacent network segment, exploiting an improper array index boundary check (CWE-129). The flaw allows a crafted network request to trigger an out-of-bounds array access, crashing or degrading availability of the affected system. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept has been identified at time of analysis; a vendor patch is available via IBM Support.
Denial of service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 is achievable by an adjacent-network attacker exploiting a null pointer dereference, capable of crashing the targeted system without requiring authentication or user interaction. The vulnerability affects IBM's enterprise UNIX operating system and its PowerVM Virtual I/O Server layer, where availability is operationally critical for hosted workloads. No public exploit code has been identified at time of analysis, and IBM has released a remediation patch via official advisory.
Kernel memory disclosure in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 exposes internal kernel memory to remote unauthenticated attackers via an out-of-bounds read (CWE-125). The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N confirms network-accessible, zero-prerequisite exploitation, though impact is bounded to partial confidentiality loss with no integrity or availability consequences. No public exploit or active exploitation has been identified at time of analysis; IBM has released a patch via advisory at https://www.ibm.com/support/pages/node/7283858.
Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is achievable by an adjacent-network attacker through a NULL pointer dereference in a network-handling code path. Exploitation requires no authentication but demands high attack complexity, substantially limiting opportunistic or internet-scale attacks. IBM has released a patch via its official support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 can be triggered by a remote, unauthenticated attacker exploiting an uninitialized stack pointer (CWE-908), leading to system unavailability. The CVSS vector scores high attack complexity (AC:H), indicating that successful exploitation requires specific conditions or timing rather than a straightforward network request. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.
Out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote authenticated attackers to trigger memory corruption leading to partial information disclosure and denial of service. The flaw (CWE-787) requires low-privilege credentials and high attack complexity, placing it at CVSS 4.2 Medium - a realistic but bounded threat profile. No public exploit code or active exploitation is confirmed at time of analysis; IBM has released a vendor patch via advisory at https://www.ibm.com/support/pages/node/7283858.
IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 expose a local denial-of-service condition through improper handling of memory page table configurations (CWE-400), allowing a low-privileged local attacker to exhaust critical kernel resources and crash or hang the system. The CVSS scope-change flag (S:C) is particularly significant in PowerVM VIOS deployments, where a triggered kernel fault in the Virtual I/O Server could cascade to affect co-hosted guest partitions or the hypervisor layer itself. IBM has released a patch via their support portal; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. [CVSS 2.9 LOW]
libxml2's xmlCatalogXMLResolveURI function is vulnerable to uncontrolled recursion when processing self-referencing delegate URI entries in XML catalogs, allowing remote attackers to trigger stack exhaustion and crash applications. This configuration-dependent denial of service requires specially crafted XML input but no authentication, affecting any application using the vulnerable library to parse untrusted catalogs. No patch is currently available.
A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. [CVSS 3.7 LOW]
IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 nimsh service SSL/TLS implementations could allow a remote attacker to execute arbitrary commands due to improper process controls. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to execute arbitrary commands due to improper process. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to traverse directories on the system. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 stores NIM private keys used in NIM environments in an insecure way which is susceptible to unauthorized access by an attacker using man in the middle. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Use-after-free memory corruption in X.Org X server's Xkb extension allows local authenticated attackers to achieve high confidentiality impact, low integrity impact, and high availability impact (CVSS 7.3) through improper resource cleanup during client disconnection. The vulnerability affects Red Hat Enterprise Linux distributions with multiple security advisories released (RHSA-2025:19432 through RHSA-2025:22055). EPSS data not provided, but the local attack vector (AV:L) and low complexity (AC:L) indicate exploitation requires authenticated local access. No CISA KEV listing or public POC identified at time of analysis.
Local privilege escalation in X.Org X server's Xkb extension affects RHEL-family distributions, allowing authenticated users to corrupt memory or crash the X server via integer overflow in XkbSetCompatMap(). Attack requires local access with low-privilege credentials. EPSS data not available; no CISA KEV listing indicates targeted rather than widespread exploitation. Red Hat has released patches across multiple RHEL versions (RHSA-2025:19432 through RHSA-2025:22055).
IBM AIX 7.2, 7.3, IBM VIOS 3.1, and 4.1, when configured to use Kerberos network authentication, could allow a local user to write to files on the system with root privileges due to improper. Rated high severity (CVSS 7.4), this vulnerability is no authentication required. No vendor patch available.
A vulnerability was found in libxml2 up to 2.14.5. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. No vendor patch available.
Local privilege escalation vulnerability in IBM AIX 7.3 and IBM VIOS 4.1.1's Perl implementation that allows non-privileged local users to execute arbitrary code through improper pathname neutralization (path traversal). With a CVSS score of 8.4 and no authentication requirement, this represents a critical risk for AIX environments where local user access exists. The vulnerability's active exploitation status and proof-of-concept availability would significantly elevate real-world risk.
IBM AIX 7.2 and 7.3 nimsh service SSL/TLS protection mechanisms could allow a remote attacker to execute arbitrary commands due to improper process controls. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM AIX 7.2 and 7.3 nimesis NIM master service could allow a remote attacker to execute arbitrary commands due to improper process controls. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM AIX 7.2, 7.3, VIOS 3.1, and 4.1 could allow a non-privileged local user to exploit a vulnerability in the TCP/IP kernel extension to cause a denial of service. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
IBM AIX 7.2, 7.3, VIOS 3.1, and 4.1 could allow a non-privileged local user to exploit a vulnerability in the AIX perfstat kernel extension to cause a denial of service. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
IBM AIX 7.2, 7.3 and VIOS 3.1 and 4.1 could allow a local user to execute arbitrary commands on the system due to improper neutralization of input. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
IBM AIX could 7.2, 7.3, VIOS 3.1, and VIOS 4.1 allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM AIX's Unix domain (AIX 7.2, 7.3, VIOS 3.1, and VIOS 4.1) datagram socket implementation could potentially expose applications using Unix domain datagram sockets with SO_PEERID operation and may. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
IBM AIX 7.3, VIOS 4.1's Perl implementation could allow a non-privileged local user to exploit a vulnerability to execute arbitrary commands. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the kernel to cause a denial of service. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the pmsvcs kernel extension to cause a denial of service. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the TCP/IP kernel extension to cause a denial of service. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the NFS kernel extension to cause a denial of service. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM AIX 7.2 and 7.3 could allow a non-privileged local user to exploit a vulnerability in the AIX SMB client to cause a denial of service. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in AIX windows to cause a denial of service. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a privileged local user to exploit a vulnerability in the qdaemon command to escalate privileges or cause a denial of service. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the piobe command to escalate privileges or cause a denial of service. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the piodmgrsu command to obtain elevated privileges. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
IBM AIX's 7.3 Python implementation could allow a non-privileged local user to exploit a vulnerability to cause a denial of service. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
IBM AIX 7.2, 7.3, VIOS 3.1's OpenSSH implementation could allow a non-privileged local user to access files outside of those allowed due to improper access controls. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX runtime services library to execute arbitrary commands. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Arbitrary command execution against IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 is possible by an unauthenticated attacker on the same network segment who can deliver DHCP option values containing unescaped shell metacharacters to the system's DHCP client. The DHCP client fails to neutralize these metacharacters before passing option data to shell processing (CWE-78), enabling full confidentiality, integrity, and availability compromise of the target host. A vendor patch is available via IBM support, and no public exploit or CISA KEV listing has been identified at time of analysis.
Heap buffer overflow in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 enables unauthenticated adjacent-network attackers to execute arbitrary code on affected systems. The CWE-787 out-of-bounds write flaw carries a CVSS score of 8.8 and yields full confidentiality, integrity, and availability compromise upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis; however, a vendor-supplied patch is available via IBM support advisory node/7283858.
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a heap buffer overflow (CWE-787 out-of-bounds write) in an affected network-facing component. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated, low-complexity network exploitation with full confidentiality, integrity, and availability impact. IBM has published a fix; no public exploit identified at time of analysis and no CISA KEV listing, so this is currently a high-severity but not confirmed-exploited issue.
OS command injection in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables an unauthenticated attacker with adjacent network access to execute arbitrary operating system commands without any user interaction. The flaw (CWE-78) resides in a network-exposed component that fails to neutralize shell metacharacters before incorporating user-supplied input into OS commands, granting full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, but a vendor patch is available via IBM support advisory.
OS command injection in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 allows an adjacent network attacker without credentials to execute arbitrary operating system commands. The flaw (CWE-78) arises from improper neutralization of special elements passed to OS command constructors, exposing the full confidentiality, integrity, and availability of affected hosts. No public exploit or CISA KEV listing has been identified at time of analysis, though a vendor patch is available via IBM Support.
Stack buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables unauthenticated remote code execution by any attacker with adjacent network access. The flaw (CWE-787, Out-of-bounds Write) corrupts stack memory during processing of a crafted network payload, allowing an attacker to overwrite return addresses and redirect execution without requiring credentials or user interaction. No public exploit has been identified at time of analysis and IBM has released a patch, but the AV:A/PR:N/AC:L vector makes this a high-priority fix for any organization running IBM Power Systems infrastructure.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering an out-of-bounds write (CWE-787) in an affected component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates the flaw is reachable over the network by unauthenticated attackers with low complexity, yielding full compromise of confidentiality, integrity, and availability. IBM has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote information disclosure in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from an integer underflow in the kernel's IPv4 IP-options parser (CWE-125 out-of-bounds read), letting a remote attacker leak sensitive memory contents by sending crafted IP packets. IBM (the reporting vendor) rates it CVSS 9.4, and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
TOCTOU race condition in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 permits a local, low-privileged user to overwrite critical system files or extract sensitive information by exploiting the timing gap between a file-check and file-use operation. The attack is constrained to local access with high exploitation complexity, yet the potential impact spans full confidentiality, integrity, and availability compromise of the affected system. No public exploit or CISA KEV listing exists at time of analysis; IBM has released a vendor patch.
Remote denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows unauthenticated network attackers to crash or exhaust resources in the SSL subsystem by omitting an expected client certificate during the TLS handshake. The CVSS 7.5 rating (AV:N/AC:L/PR:N/UI:N) confirms low attack complexity with no authentication required, making exploitation straightforward against any exposed SSL service on affected systems. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the patch is available and should be prioritized for internet-facing AIX and VIOS deployments.
Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables unauthenticated remote attackers to exhaust system resources via network-delivered input, fully disabling availability (CVSS A:H) without any confidentiality or integrity impact. The vulnerability is rooted in CWE-400 uncontrolled resource consumption, triggered from the network with no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N). No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available from IBM.
Denial of service in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker crash or hang the affected system by triggering an integer underflow (CWE-190) in a network-reachable component. The flaw was reported by IBM, which has released a fix; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. Note that IBM's published CVSS 9.8 claims full confidentiality/integrity/availability impact, which conflicts with the description's DoS-only wording.
Denial of service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 allows unauthenticated remote attackers to exhaust system resources and render affected systems unavailable by sending crafted network input that triggers uncontrolled resource consumption (CWE-400). The CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms low-complexity, unauthenticated remote exploitability with a high availability impact. No active exploitation has been confirmed in CISA KEV, and no public exploit code is known at time of analysis; a vendor patch is available via IBM's support portal.
Unbounded recursion in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 exposes these systems to remote denial-of-service attacks requiring no authentication or user interaction. Network-reachable attackers can trigger uncontrolled resource consumption, exhausting stack or memory resources and disrupting availability of affected systems. No public exploit code has been identified and CISA KEV does not list this vulnerability; a vendor-released patch is available via IBM's support portal.
TNC policy server impersonation in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a network-positioned attacker forge the Trusted Network Connect policy server and tamper with the traffic between it and the endpoint, because the client fails to properly validate the server's certificate (CWE-295). An attacker who can intercept the session can present a fraudulent certificate, read limited data and alter integrity-critical policy exchanges. IBM has released a fix; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
IBM AIX 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, expose a time-of-check time-of-use (TOCTOU) race condition that local, unprivileged attackers can exploit to corrupt data integrity or crash the system. The flaw requires only local shell access with no privileges, making it exploitable by any local user account on affected POWER-architecture systems. No public exploit code or CISA KEV listing exists at time of analysis, though a vendor patch is available.
Uncontrolled resource consumption in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 exposes these systems to remote denial-of-service attacks requiring no authentication or user interaction. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms any network-reachable attacker can trigger availability loss without special privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and a vendor patch is available.
IBM AIX 7.2 and 7.3, and PowerVM VIOS 4.1 expose an unauthenticated remote denial-of-service condition rooted in a NULL pointer dereference. A remote attacker with no credentials or user interaction can crash affected network-accessible components, resulting in complete availability loss (A:H) with no confidentiality or integrity impact. No public exploit code or active exploitation has been confirmed at time of analysis, and IBM has released a patch via advisory https://www.ibm.com/support/pages/node/7283858.
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute arbitrary operating-system commands due to improper neutralization of special elements (CWE-78). Rated CVSS 9.9 with a scope change, a successful low-privilege attacker can break out of the application context and run commands on the underlying enterprise Unix host, threatening confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and network reachability make it a high-priority patch.
Heap buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables unauthenticated remote code execution by attackers positioned on an adjacent network segment, with no user interaction required. The flaw (CWE-787, out-of-bounds write) results in full compromise of confidentiality, integrity, and availability of the affected system. A vendor patch has been released via IBM advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote denial-of-service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 is caused by a CWE-787 out-of-bounds write reachable by unauthenticated network attackers with no complexity prerequisites. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects straightforward remote triggering with high availability impact but no confidentiality or integrity consequence. IBM has released a patch via the vendor advisory; no public exploit code has been identified at time of analysis.
Local privilege escalation in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows an authenticated low-privileged user to gain full elevated privileges due to improper privilege management (CWE-269). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that any standard local user account is sufficient to trigger the flaw with low complexity and no user interaction, resulting in complete confidentiality, integrity, and availability compromise of the affected system. No public exploit identified at time of analysis, and a vendor patch is available via IBM advisory.
Remote denial-of-service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables an unauthenticated network attacker to exhaust system resources and crash or severely degrade affected hosts. The root cause is uncontrolled resource consumption (CWE-400), exploitable without authentication or user interaction via a network-accessible service. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch addressed in advisory node/7283858.
Unauthenticated remote access to NFS-exported filesystems is possible in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 due to improper authentication (CWE-287). The CVSS vector AV:N/AC:L/PR:N/UI:N confirms that unauthenticated remote attackers on the network can exploit this with low complexity and no user interaction, gaining high-confidence read access and limited write access to exported filesystem data. No public exploit has been identified at time of analysis, and IBM has released a patch via advisory 7283858.
Remote denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is exploitable by unauthenticated attackers who send malformed client registration packets to the NIM (Network Installation Manager) server, triggering a classic buffer overflow that crashes the nimserver daemon. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms low-complexity, network-accessible exploitation requiring no privileges, though impact is strictly limited to availability - no confidentiality or integrity exposure is present. IBM has released a patch via support advisory 7283858; no public exploit code has been identified and this vulnerability does not appear on the CISA KEV catalog at time of analysis.
Remote privilege escalation to root in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 stems from an improper authentication weakness (CWE-287) that lets an unauthenticated network attacker bypass identity checks and obtain root-level control. The CVSS 9.8 rating reflects a network-reachable, low-complexity flaw requiring no privileges or user interaction, with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the severity and unauthenticated network vector make it a high-priority patching target for IBM Power estates.
Improper TLS certificate validation in the NIM (Network Installation Management) subsystem of IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 enables remote attackers to gain unauthorized access to AIX systems by exploiting the failure to verify certificate authenticity during NIM communications. The CVSS 8.1 High score reflects high confidentiality and integrity impact across a network-exploitable path with low complexity and no user interaction required. No public exploit identified at time of analysis, but the authentication bypass classification of this flaw makes it a meaningful privilege escalation and lateral movement risk in IBM Power environments.
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands through the Network Installation Manager (NIM) component. Because NIM typically operates with high (often root-level) privilege and the CVSS scope is Changed, successful exploitation can compromise the underlying operating system with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the 9.9 base score and low attack complexity make it a high-priority patch for IBM Power estates.
Sensitive-key exposure in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 Network Installation Management (NIM) leaks intermediate certificate authority (CA) private keys inside a publicly downloadable update file, letting remote attackers forge trusted certificates and bypass security restrictions. Rated CVSS 9.1, the flaw impacts confidentiality and integrity (C:H/I:H) but not availability, and IBM has released a fix. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the ease of obtaining a live CA key makes this a high-priority credential-hygiene issue.
Unauthenticated remote file overwrite in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is possible via the nimesis registration service, which fails to sanitize path traversal sequences in client-supplied input. An attacker with network access to the nimesis service can write arbitrary content to locations outside the intended directory, potentially overwriting sensitive system files such as cron jobs, init scripts, or authentication databases. No public exploit or active exploitation has been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is straightforwardly exploitable without authentication.
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, allow local users to gain privileges via vectors involving (1) arp.ib or (2). Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Uncontrolled resource consumption in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a local high-privileged attacker to cause a denial of service by supplying crafted directory records to the vulnerable parsing component. The CVSS vector (AV:L/PR:H) confirms that exploitation is constrained to authenticated local actors with elevated privileges, limiting the realistic threat pool considerably. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Path traversal in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote, unauthenticated attackers to bypass directory-based access controls by supplying manipulated pathname inputs that escape restricted filesystem boundaries. The vulnerability carries a CVSS 3.1 score of 4.8 (Medium) with high attack complexity (AC:H), which constrains opportunistic exploitation while still leaving targeted attacks viable without requiring credentials. No public exploit code or active exploitation has been identified at time of analysis; IBM has published an advisory at their support portal (https://www.ibm.com/support/pages/node/7283858).
Out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables a local, low-privileged attacker to crash the affected system, resulting in a denial of service. The CVSS scope-change metric (S:C) is particularly significant in the PowerVM context: a crash of the VIOS host can simultaneously disrupt I/O services for all co-hosted guest logical partitions (LPARs) sharing that VIOS, amplifying the blast radius well beyond the directly exploited node. No public exploit code and no confirmed active exploitation have been identified at time of analysis.
NULL pointer dereference in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a local low-privileged attacker to crash the system, causing a denial of service. Exploitation requires high attack complexity, suggesting a race condition or specific system state must be induced. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog; a vendor patch is available via IBM support.
Symlink following vulnerability in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 allows a local low-privileged attacker to cause a denial of service - and potentially file corruption - through improper symbolic link validation (CWE-59). The CVSS vector (AV:L/AC:H/PR:L/I:H/A:H) indicates exploitation requires local access, a race-condition timing window, and results in both high integrity and availability impact despite the DoS classification. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; IBM has released a patch.
Kernel memory disclosure in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows a local attacker with standard user privileges to read sensitive out-of-bounds kernel memory via an unspecified vulnerability. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a local shell account with no elevated rights, making it viable for any authenticated local user or a compromised service account. No public exploit code has been identified at time of analysis, and IBM has released a patch via the vendor advisory.
IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 expose sensitive information over the network, enabling remote unauthenticated attackers to intercept in-flight messages and forge replies. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials or user interaction, making any network-adjacent attacker a potential threat. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; IBM has released a patch.
Uncontrolled resource consumption in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1, enables a local low-privileged attacker to exhaust system resources and trigger a denial of service condition. The vulnerability is classified under CWE-400 and carries a CVSS 3.1 base score of 5.5 with a local attack vector requiring low privileges. IBM has released a patch via advisory 7283858; no active exploitation or public proof-of-concept code has been identified at time of analysis.
Heap-based buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables a local authenticated attacker with high privileges to execute arbitrary code on affected systems. The vulnerability is rooted in improper memory management (CWE-787) and carries a CVSS 3.1 score of 6.7, reflecting the local access requirement and elevated privilege prerequisite that constrain real-world exploitability. IBM has released a patch via its support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables a local, high-privileged attacker to execute arbitrary code. The vulnerability is rooted in a memory corruption flaw (CWE-787) that can corrupt adjacent memory regions during a write operation. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Local denial-of-service in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows a high-privileged local attacker to crash the system via an out-of-bounds write condition. The attack is constrained to local access with elevated privileges (PR:H per CVSS), limiting the practical blast radius primarily to insider threats or post-compromise scenarios. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in a lower-urgency triage category despite the severity of the availability impact.
Out-of-bounds memory read in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a local authenticated attacker to disclose sensitive information from adjacent memory regions. The flaw is constrained entirely to local access with low privileges, yielding a CVSS score of 3.3 (Low), and poses greatest risk in shared or multi-tenant Power Systems environments where untrusted users hold shell access. No public exploit code or active exploitation has been identified at time of analysis.
Integer overflow in IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1 allows a local attacker with limited privileges to extract sensitive information or trigger a denial of service under specific high-complexity conditions. Rooted in CWE-190 (Integer Overflow or Wraparound), the vulnerability carries a CVSS 3.1 base score of 3.6 (Low), reflecting the mandatory local access requirement and elevated attack complexity. No public exploit code or active exploitation has been identified at the time of analysis.
Denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 is achievable by an unauthenticated adjacent-network attacker exploiting an out-of-bounds write (CWE-787) in a network-accessible component. Successful exploitation crashes or degrades the target system without impacting confidentiality or data integrity. No public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 exposes sensitive files to remote, unauthenticated attackers over the network. The flaw (CWE-22) allows directory traversal sequences to escape an intended path boundary, enabling read access to files that should not be externally accessible. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Out-of-bounds memory read in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 exposes sensitive system memory to locally authenticated users holding low-privilege accounts. The flaw (CWE-125) allows an attacker with existing local access to read memory contents beyond intended buffer boundaries, producing high confidentiality impact while leaving system integrity and availability unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via advisory 7283858.
Out-of-bounds read (CWE-125) in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 exposes a remotely reachable attack surface that allows unauthenticated network attackers to cause a denial of service under high-complexity conditions. The CVSS vector also records a limited integrity impact (I:L), which is inconsistent with the description's exclusive mention of denial of service and warrants verification against the vendor advisory. No public exploit code or active exploitation has been identified; a vendor patch is available from IBM.
Heap buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables a local low-privileged attacker to crash the system, resulting in a denial of service. The flaw is rooted in improper bounds checking during heap memory operations (CWE-787). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, a vendor-released patch is available via IBM advisory node/7283858.
Denial of service in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 is achievable by unauthenticated remote attackers positioned on an adjacent network segment, exploiting an improper array index boundary check (CWE-129). The flaw allows a crafted network request to trigger an out-of-bounds array access, crashing or degrading availability of the affected system. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept has been identified at time of analysis; a vendor patch is available via IBM Support.
Denial of service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 is achievable by an adjacent-network attacker exploiting a null pointer dereference, capable of crashing the targeted system without requiring authentication or user interaction. The vulnerability affects IBM's enterprise UNIX operating system and its PowerVM Virtual I/O Server layer, where availability is operationally critical for hosted workloads. No public exploit code has been identified at time of analysis, and IBM has released a remediation patch via official advisory.
Kernel memory disclosure in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 exposes internal kernel memory to remote unauthenticated attackers via an out-of-bounds read (CWE-125). The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N confirms network-accessible, zero-prerequisite exploitation, though impact is bounded to partial confidentiality loss with no integrity or availability consequences. No public exploit or active exploitation has been identified at time of analysis; IBM has released a patch via advisory at https://www.ibm.com/support/pages/node/7283858.
Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is achievable by an adjacent-network attacker through a NULL pointer dereference in a network-handling code path. Exploitation requires no authentication but demands high attack complexity, substantially limiting opportunistic or internet-scale attacks. IBM has released a patch via its official support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 can be triggered by a remote, unauthenticated attacker exploiting an uninitialized stack pointer (CWE-908), leading to system unavailability. The CVSS vector scores high attack complexity (AC:H), indicating that successful exploitation requires specific conditions or timing rather than a straightforward network request. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.
Out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote authenticated attackers to trigger memory corruption leading to partial information disclosure and denial of service. The flaw (CWE-787) requires low-privilege credentials and high attack complexity, placing it at CVSS 4.2 Medium - a realistic but bounded threat profile. No public exploit code or active exploitation is confirmed at time of analysis; IBM has released a vendor patch via advisory at https://www.ibm.com/support/pages/node/7283858.
IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 expose a local denial-of-service condition through improper handling of memory page table configurations (CWE-400), allowing a low-privileged local attacker to exhaust critical kernel resources and crash or hang the system. The CVSS scope-change flag (S:C) is particularly significant in PowerVM VIOS deployments, where a triggered kernel fault in the Virtual I/O Server could cascade to affect co-hosted guest partitions or the hypervisor layer itself. IBM has released a patch via their support portal; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. [CVSS 2.9 LOW]
libxml2's xmlCatalogXMLResolveURI function is vulnerable to uncontrolled recursion when processing self-referencing delegate URI entries in XML catalogs, allowing remote attackers to trigger stack exhaustion and crash applications. This configuration-dependent denial of service requires specially crafted XML input but no authentication, affecting any application using the vulnerable library to parse untrusted catalogs. No patch is currently available.
A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. [CVSS 3.7 LOW]
IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 nimsh service SSL/TLS implementations could allow a remote attacker to execute arbitrary commands due to improper process controls. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to execute arbitrary commands due to improper process. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to traverse directories on the system. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 stores NIM private keys used in NIM environments in an insecure way which is susceptible to unauthorized access by an attacker using man in the middle. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Use-after-free memory corruption in X.Org X server's Xkb extension allows local authenticated attackers to achieve high confidentiality impact, low integrity impact, and high availability impact (CVSS 7.3) through improper resource cleanup during client disconnection. The vulnerability affects Red Hat Enterprise Linux distributions with multiple security advisories released (RHSA-2025:19432 through RHSA-2025:22055). EPSS data not provided, but the local attack vector (AV:L) and low complexity (AC:L) indicate exploitation requires authenticated local access. No CISA KEV listing or public POC identified at time of analysis.
Local privilege escalation in X.Org X server's Xkb extension affects RHEL-family distributions, allowing authenticated users to corrupt memory or crash the X server via integer overflow in XkbSetCompatMap(). Attack requires local access with low-privilege credentials. EPSS data not available; no CISA KEV listing indicates targeted rather than widespread exploitation. Red Hat has released patches across multiple RHEL versions (RHSA-2025:19432 through RHSA-2025:22055).
IBM AIX 7.2, 7.3, IBM VIOS 3.1, and 4.1, when configured to use Kerberos network authentication, could allow a local user to write to files on the system with root privileges due to improper. Rated high severity (CVSS 7.4), this vulnerability is no authentication required. No vendor patch available.
A vulnerability was found in libxml2 up to 2.14.5. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. No vendor patch available.
Local privilege escalation vulnerability in IBM AIX 7.3 and IBM VIOS 4.1.1's Perl implementation that allows non-privileged local users to execute arbitrary code through improper pathname neutralization (path traversal). With a CVSS score of 8.4 and no authentication requirement, this represents a critical risk for AIX environments where local user access exists. The vulnerability's active exploitation status and proof-of-concept availability would significantly elevate real-world risk.
IBM AIX 7.2 and 7.3 nimsh service SSL/TLS protection mechanisms could allow a remote attacker to execute arbitrary commands due to improper process controls. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM AIX 7.2 and 7.3 nimesis NIM master service could allow a remote attacker to execute arbitrary commands due to improper process controls. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM AIX 7.2, 7.3, VIOS 3.1, and 4.1 could allow a non-privileged local user to exploit a vulnerability in the TCP/IP kernel extension to cause a denial of service. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
IBM AIX 7.2, 7.3, VIOS 3.1, and 4.1 could allow a non-privileged local user to exploit a vulnerability in the AIX perfstat kernel extension to cause a denial of service. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
IBM AIX 7.2, 7.3 and VIOS 3.1 and 4.1 could allow a local user to execute arbitrary commands on the system due to improper neutralization of input. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
IBM AIX could 7.2, 7.3, VIOS 3.1, and VIOS 4.1 allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM AIX's Unix domain (AIX 7.2, 7.3, VIOS 3.1, and VIOS 4.1) datagram socket implementation could potentially expose applications using Unix domain datagram sockets with SO_PEERID operation and may. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
IBM AIX 7.3, VIOS 4.1's Perl implementation could allow a non-privileged local user to exploit a vulnerability to execute arbitrary commands. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the kernel to cause a denial of service. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the pmsvcs kernel extension to cause a denial of service. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the TCP/IP kernel extension to cause a denial of service. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the NFS kernel extension to cause a denial of service. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM AIX 7.2 and 7.3 could allow a non-privileged local user to exploit a vulnerability in the AIX SMB client to cause a denial of service. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in AIX windows to cause a denial of service. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a privileged local user to exploit a vulnerability in the qdaemon command to escalate privileges or cause a denial of service. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the piobe command to escalate privileges or cause a denial of service. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the piodmgrsu command to obtain elevated privileges. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
IBM AIX's 7.3 Python implementation could allow a non-privileged local user to exploit a vulnerability to cause a denial of service. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
IBM AIX 7.2, 7.3, VIOS 3.1's OpenSSH implementation could allow a non-privileged local user to access files outside of those allowed due to improper access controls. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX runtime services library to execute arbitrary commands. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.