IBM

Local denial-of-service in IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 allows a local attacker to exhaust system resources and render the platform unavailable, without requiring any credentials. The vulnerability stems from improper resource allocation controls (CWE-770), meaning the system places no effective cap on resource consumption triggered by local access. No public exploit has been identified at time of analysis, and a vendor patch is available via IBM's support portal.

SQL injection in IBM Concert versions 1.0.0 through 2.3.1 allows remote attackers to inject specially crafted SQL statements and read, insert, modify, or delete arbitrary data in the back-end database. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, low-complexity exploitation with no authentication or user interaction, yielding high confidentiality and integrity impact. A vendor patch is available; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Authenticated command injection in IBM Langflow OSS 1.0.0 through 1.11.1 lets any logged-in flow user escalate to arbitrary OS command execution under the server process identity. By saving a flow containing a crafted 'type' field and triggering a build of a wrapper flow that references it, the attacker coerces the backend into evaluating attacker-controlled code, defeating the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false guardrail intended to block custom code execution. The vendor (IBM) reported it and has released a fix; there is no public exploit identified at time of analysis and it is not in CISA KEV.

Broken object-level authorization in IBM Langflow OSS 1.0.0 through 1.11.1 allows any authenticated network user to read and execute private flows belonging to other users. The flaw (CWE-639) stems from the application accepting user-controlled flow identifiers in API requests without verifying that the requesting account owns the targeted resource - a classic horizontal privilege escalation path. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but a vendor patch is available via IBM Security Advisory.

Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 arises from the A2A (agent-to-agent) public endpoint failing to properly enforce security restrictions, letting a network attacker inject and run arbitrary code on the host. The CWE-94 code-injection flaw carries a critical 9.8 CVSS score with a network, no-privilege, no-interaction vector, meaning any reachable instance is directly at risk. IBM has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Namespace collision between user identifiers in IBM Langflow OSS 1.0.0 through 1.11.1 exposes sensitive information and enables unauthorized message injection by unauthenticated remote attackers. The flaw, rooted in CWE-639 (authorization bypass via user-controlled key), allows an attacker to resolve or collide with another user's namespace without requiring authentication, as confirmed by the CVSS vector (PR:N). No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, network-accessible attack surface warrants prompt remediation.

Path traversal in IBM Langflow OSS 1.0.0 through 1.11.1 exposes arbitrary server-side files to unauthenticated remote attackers over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity exploitation requiring no credentials or user interaction, with high confidentiality impact limited to file reads - no write or availability impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated network vector and low attack complexity make internet-facing instances a realistic opportunistic target once details circulate.

Remote unauthenticated execution of arbitrary AI workflows in IBM Langflow OSS 1.0.0 through 1.11.1 exposes sensitive information via an authentication bypass (CWE-287). The CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) confirms zero prerequisites - any network-reachable instance can be targeted without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial attack complexity combined with high confidentiality impact and vendor-confirmed patch availability makes this an immediate remediation priority for any organization running an exposed Langflow instance.

Remote code execution in IBM Langflow OSS 1.0.0 through 1.11.1 allows a network-accessible authenticated attacker with low privileges to inject and execute arbitrary code server-side due to improper control of code generation (CWE-94). The CVSS 8.8 High score reflects low attack complexity, no required user interaction, and full confidentiality, integrity, and availability impact against the vulnerable host. IBM has released a patch; no public exploit or CISA KEV listing is identified at time of analysis.

Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated low-privilege attacker to coerce the application server into issuing arbitrary outbound HTTP requests, enabling internal network enumeration and potentially pivoting to other attacks against backend infrastructure. The CVSS vector (PR:L/AV:N/AC:L) confirms this is exploitable over the network by any authenticated user without elevated permissions or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via their support portal.

Privilege escalation via session fixation in IBM Administration Runtime Expert (ARE) for i, version 1R1M0, lets a remote attacker cause actions to run under another user's authenticated profile through flawed handling in the ARE GUI component, yielding elevated privileges on the IBM i host. The description characterizes the attacker as unauthenticated, though the CVSS 3.1 vector (PR:L) implies some low-privilege foothold - this signal conflict should be confirmed with IBM. No public exploit identified at time of analysis, and it is not on CISA KEV; EPSS was not provided.

Improper authentication enforcement in IBM Administration Runtime Expert for i 1R1M0 exposes sensitive information to remote attackers over the network. The flaw (CWE-287) allows an attacker to bypass or circumvent authentication controls on protected endpoints, resulting in high-confidentiality-impact disclosure with no integrity or availability consequence. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory node/7284580.

Local privilege escalation in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 stems from a format string vulnerability (CWE-134), enabling a low-privileged local attacker to achieve full system compromise - high confidentiality, integrity, and availability impact consistent with root-level access. The CVSS vector (AV:L/AC:H/PR:L) confirms this requires existing local access and elevated attack complexity, limiting opportunistic exploitation. No public exploit identified at time of analysis, and no CISA KEV listing; a vendor patch is available via IBM support advisory.

IBM Concert versions 1.0.0 through 2.3.1 expose deployments to man-in-the-middle attacks due to improper TLS certificate validation (CWE-295), enabling remote attackers to intercept and manipulate communications between Concert components. The integrity impact is rated High by IBM's own CVSS scoring, meaning an adversary successfully positioned in the network path can perform unauthorized actions against affected Concert instances. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory 7285337.

IBM Integrated Analytics System versions 1.0.0.0 through 1.0.31.0 fails to properly validate TLS certificates, enabling network-positioned attackers to conduct man-in-the-middle attacks and intercept sensitive data in transit. IBM has confirmed the issue and released a patch via advisory node/7285149. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the network-accessible attack vector with no authentication requirement raises the relevance for deployments where the system communicates across untrusted network segments.

IBM Integrated Analytics System versions 1.0.0.0 through 1.0.31.0 employs cryptographic algorithms below acceptable security standards, exposing highly sensitive data to decryption by a network-positioned attacker. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates network exploitation without authentication but requires high attack complexity, consistent with a passive interception or man-in-the-middle scenario. No public exploit code has been identified, and IBM has released a remediation patch via support advisory 7285147.

Credential exposure in rclone before v1.75.0 allows network-adjacent attackers to capture IBM IAM bearer tokens during same-host HTTPS-to-HTTP redirect downgrades, or SSE-C customer-provided encryption keys during cross-origin S3 redirects. The S3 redirect callback in s3.go correctly strips X-Amz-Security-Token on host changes but omits IBM IAM Authorization headers and SSE-C key headers from its denylist, exploiting a gap in Go's built-in redirect sanitization that does not treat scheme downgrades as a credential boundary. A proof-of-concept is documented in GHSA-8mxv-9xhp-86h4; no public exploit tool has been independently identified, and the vulnerability is not listed in CISA KEV at time of analysis.

Kernel-stack out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables a local attacker with low-privilege shell access to corrupt kernel memory by causing the kernel to parse a crafted filesystem image during directory reads. Successful exploitation can crash the system or escalate privileges to root, yielding full system compromise. No public exploit code has been identified and EPSS remains very low at 0.16% (6th percentile), though SSVC rates technical impact as total, reflecting the severity of a successful local privilege escalation on IBM Power infrastructure.

Local privilege escalation in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 allows an unprivileged local user to execute arbitrary payloads as root via the cmdnim utility. The CVSS vector (AV:L/AC:L/PR:L/S:C/C:H/I:H/A:H) confirms that any standard authenticated user account is sufficient to achieve full root-level code execution with no user interaction and no special configuration required. No public exploit has been identified at time of analysis, and this CVE is not currently listed in CISA KEV.

Stack memory corruption in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote denial of service by crashing the host kernel through a crafted IPsec ESP packet. The flaw (CWE-908: Use of Uninitialized Resource) resides in the ESP decapsulation handler, where uninitialized stack memory can be corrupted before proper validation, causing a system panic. No active exploitation is confirmed (absent from CISA KEV) and EPSS stands at 0.32%, but the PowerVM VIOS attack surface carries an amplified blast radius: a VIOS crash disrupts I/O services for all co-hosted logical partitions simultaneously.

Remote denial-of-service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows an unauthenticated network attacker to crash affected systems by sending a crafted UDP packet to the RPC service. The attack requires no credentials or user interaction and results in complete system unavailability, demanding an LPAR restart to recover - a non-trivial operational impact for enterprise environments running critical POWER-based workloads. No public exploit code has been identified at time of analysis, but the trivially low attack complexity against a zero-authentication network service elevates practical risk.

Untrusted pointer dereference (CWE-822) in IBM AIX's Virtual SCSI (vSCSI) initiator driver allows a low-privileged local user within a client LPAR to trigger kernel memory corruption, with outcomes spanning denial of service, privilege escalation, or full compromise of the client LPAR kernel. Affecting IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1, the CVSS 3.1 score of 8.8 with scope change (S:C) reflects the cross-LPAR isolation risk inherent in PowerVM virtualization environments where VIOS mediates I/O for multiple tenants. No public exploit code or active exploitation has been identified at time of analysis; however, CISA's SSVC framework rates the technical impact as total, meaning successful exploitation fully undermines the security of the affected system.

Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a remote attacker can trigger to run arbitrary code with high confidentiality, integrity, and availability impact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, unauthenticated exploitation, and IBM PSIRT has published a support advisory. There is no public exploit identified at time of analysis, EPSS is modest (0.61%, 47th percentile), and CISA SSVC rates exploitation as 'none' with technical impact 'total'.

Local privilege escalation in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a low-privileged local attacker to gain elevated privileges by exploiting an out-of-bounds write (CWE-787) memory corruption flaw. The vulnerability affects IBM's enterprise Unix operating system and its virtualization platform, with full confidentiality, integrity, and availability impact confirmed by the CVSS vector. No public exploit code or active exploitation has been identified at time of analysis, and EPSS rates the exploitation probability at just 0.17% (6th percentile), consistent with the SSVC assessment of exploitation status as none.

Arbitrary code execution on IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a CWE-822 untrusted pointer dereference, where a locally authenticated, low-privilege attacker can supply a crafted pointer value that the OS or VIOS component fails to validate before dereferencing. Successful exploitation yields full confidentiality, integrity, and availability compromise of the affected system (CVSS 7.8 High, C:H/I:H/A:H). No public exploit or CISA KEV listing exists at time of analysis; SSVC rates exploitation status as none and the attack as non-automatable.

OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker run arbitrary operating-system commands due to improper neutralization of special elements (CWE-78). IBM PSIRT rates it CVSS 9.9 with a scope change, reflecting that an authenticated foothold can be escalated into full host compromise across the confidentiality, integrity, and availability dimensions. No public exploit identified at time of analysis and it is not listed in CISA KEV, so the current threat is potential rather than confirmed in-the-wild activity.

Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a heap-based buffer overflow (CWE-787) that a remote attacker can trigger without authentication or user interaction, per the CVSS 9.8 vector. Successful exploitation yields full compromise of the affected Unix host or virtualization I/O server. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.41%, 35th percentile), with CISA SSVC recording no observed exploitation.

Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows remote unauthenticated attackers to crash affected systems, producing a denial of service. The CVSS 3.1 vector scores this at 7.5 High with no authentication or user interaction required, targeting availability exclusively. No active exploitation is confirmed by CISA KEV, and the EPSS score of 0.29% (21st percentile) indicates low real-world exploitation probability at time of analysis.

OS command injection in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 permits a remote attacker holding high-privileged credentials to execute arbitrary operating system commands, with impact extending beyond the vulnerable component (scope change) to achieve full confidentiality, integrity, and availability compromise. The CVSS 3.1 score of 8.4 (AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) reflects that while network-exploitable with low complexity, exploitation requires both elevated authentication and a user interaction trigger. No public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog at the time of analysis.

Uncontrolled resource consumption in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a local high-privileged attacker to cause a denial of service by supplying crafted directory records to the vulnerable parsing component. The CVSS vector (AV:L/PR:H) confirms that exploitation is constrained to authenticated local actors with elevated privileges, limiting the realistic threat pool considerably. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.

Information disclosure and denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stem from an out-of-bounds read (CWE-125) reachable over the network, letting a remote attacker read sensitive memory contents or crash the affected service. The vulnerability carries a CVSS 9.1 rating driven by high confidentiality and availability impact, though EPSS places exploitation probability very low (0.19%, 10th percentile) and CISA's SSVC framework records no known exploitation. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote denial-of-service and potential information disclosure in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 arises from an integer underflow (CWE-190 class) reachable over the network without authentication. An unauthenticated remote attacker can send crafted input that triggers the arithmetic wraparound, crashing an affected service and possibly reading sensitive memory contents. There is no public exploit identified at time of analysis, EPSS is low (0.51%, 41st percentile), and it is not on CISA KEV.

Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 stems from a heap-based buffer overflow (CWE-787) that a remote attacker can trigger over the network without authentication or user interaction. Per its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) the flaw is critical (9.8) with total confidentiality, integrity, and availability impact, though the description does not name the specific network service or daemon that parses the malformed input. There is no public exploit identified at time of analysis, and EPSS is low (0.41%, 35th percentile), consistent with CISA SSVC scoring exploitation as 'none'.

Stack buffer overflow in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote unauthenticated denial of service via network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication is required and exploitation is low-complexity, making the availability impact (A:H) readily achievable by any network-reachable attacker. No public exploit code or CISA KEV listing has been identified at time of analysis, but the absence of authentication and complexity barriers makes this a meaningful operational risk for IBM Power environments where availability is typically mission-critical.

Path traversal in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote, unauthenticated attackers to bypass directory-based access controls by supplying manipulated pathname inputs that escape restricted filesystem boundaries. The vulnerability carries a CVSS 3.1 score of 4.8 (Medium) with high attack complexity (AC:H), which constrains opportunistic exploitation while still leaving targeted attacks viable without requiring credentials. No public exploit code or active exploitation has been identified at time of analysis; IBM has published an advisory at their support portal (https://www.ibm.com/support/pages/node/7283858).

Out-of-bounds read in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 exposes sensitive memory contents and enables denial of service against affected systems. The flaw is reachable by remote attackers according to the vendor description, enabling both unauthorized information disclosure and availability disruption without authentication. No public exploit code or active exploitation has been identified at time of analysis, though the high CVSS score and dual-impact (C:H, A:H) profile elevate priority for affected IBM UNIX and virtualization environments.

Local privilege escalation via buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an attacker with low-privileged local access to execute arbitrary code with a changed scope, meaning impact can extend beyond the vulnerable component - particularly significant in VIOS hypervisor environments where guest-to-host or cross-partition compromise may be achievable. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C) reflects low-friction exploitation once local access is established, with full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis and EPSS is very low at 0.18% (8th percentile), but SSVC rates technical impact as total, warranting prioritization in Power Systems environments.

Out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables a local, low-privileged attacker to crash the affected system, resulting in a denial of service. The CVSS scope-change metric (S:C) is particularly significant in the PowerVM context: a crash of the VIOS host can simultaneously disrupt I/O services for all co-hosted guest logical partitions (LPARs) sharing that VIOS, amplifying the blast radius well beyond the directly exploited node. No public exploit code and no confirmed active exploitation have been identified at time of analysis.

Symlink following in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 allows a local low-privileged attacker to overwrite arbitrary files on the system, including those owned by root. The flaw stems from improper resolution of symbolic links (CWE-59) during privileged file operations, enabling integrity and availability impacts equivalent to a high-severity local privilege escalation primitive. No public exploit identified at time of analysis and it does not appear in the CISA KEV catalog, but the CVSS 7.8 High rating reflects the significant impact of arbitrary file overwrite on a privileged OS.

Denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 is reachable by unauthenticated remote attackers through improper validation of an allocation size, crashing the affected system or service without any user interaction. The vulnerability carries a CVSS 7.5 High score driven entirely by a complete availability impact against a network-accessible, zero-prerequisite attack path. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Remote code execution is possible in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 via a stack-based buffer overflow exploitable by a remote attacker holding low-privilege credentials. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact with a network attack vector and no user interaction required beyond authentication. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS of 0.56% (44th percentile) indicates limited current exploitation activity despite high potential impact.

Remote denial of service in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 is achievable by an unauthenticated attacker via a NULL pointer dereference (CWE-476) in a network-accessible component, yielding full availability loss against affected systems. The vulnerability carries a CVSS 7.5 High score with no confidentiality or integrity exposure. No public exploit code or CISA KEV listing has been identified at time of analysis.

Denial of service in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 allows a remote unauthenticated attacker to crash affected systems by supplying a crafted request that exploits improper validation of an array size field. The CVSS 7.5 (High) score reflects a fully network-exploitable, zero-complexity, no-privilege-required attack path targeting availability exclusively. No public exploit code and no CISA KEV listing have been identified at time of analysis, suggesting this has not yet been weaponized at scale.

Remote code execution in IBM AIX 7.2 and 7.3, and in IBM PowerVM VIOS 4.1, arises from an integer overflow (CWE-190) during a size computation that a remote attacker can trigger to run arbitrary code. The CVSS 9.8 vector indicates network-reachable, unauthenticated exploitation with no user interaction, giving full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the maximal CVSS and RCE nature make this a top-priority patch for affected Power/AIX estates.

Remote denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 is achievable by unauthenticated remote attackers via an integer overflow (CWE-190) in a network-reachable component. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation requires no authentication and no special configuration, making all internet- or network-exposed instances directly at risk. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.

Remote code execution in IBM AIX 7.2 and 7.3 (and IBM PowerVM VIOS 4.1) stems from a stack-based buffer overflow that lets a remote attacker overwrite memory and run arbitrary code on the host. IBM PSIRT rated it CVSS 9.8, and the vector indicates network-reachable, unauthenticated exploitation requiring no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of unauthenticated RCE on an enterprise Unix platform makes it a high-priority patch.

Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a remote attacker can trigger to run arbitrary code on affected IBM Power-based Unix systems. The flaw was reported by IBM's own PSIRT and carries a CVSS 9.8 rating reflecting network-reachable, unauthenticated, no-interaction exploitation with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the severity and privileged role of these platforms make it a high-priority patching item.

Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from improper privilege management (CWE-269), letting a remote attacker run arbitrary code on affected Power systems per IBM PSIRT. The 9.8 CVSS score reflects a network-reachable, low-complexity vector with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the IBM support advisory indicates a fix is available.

Improper authentication in IBM AIX 7.2 and 7.3, and in IBM PowerVM VIOS 4.1, allows a remote attacker to execute arbitrary commands on affected systems. The flaw carries a critical CVSS 9.8 rating (network-reachable, no privileges or user interaction) and, per IBM's own PSIRT advisory, an authentication bypass can lead to full command execution. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.

Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a remote attacker can trigger without authentication or user interaction, yielding full compromise of the affected system. IBM PSIRT rates it CVSS 9.8, reflecting complete confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 arises from a stack-based buffer overflow (CWE-121) that a remote attacker can trigger without authentication or user interaction, yielding total compromise of these Power-based enterprise Unix and virtualization-management systems. The CVSS 9.8 rating reflects a fully remote, low-complexity path to arbitrary code execution with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low (0.61%, 47th percentile), indicating no observed widespread exploitation yet despite the critical severity.

Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 arises from a format string weakness (CWE-134) that a remote, unauthenticated attacker can leverage to run arbitrary code, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scoring 9.8 critical. IBM PSIRT is the reporting source and a single vendor support advisory is referenced; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. The affected component or listening service is not named in the available data, so the exact remote entry point is unconfirmed.

Local arbitrary code execution in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1, stems from an out-of-bounds read (CWE-125) exploitable by a low-privileged local user with no user interaction required. A successful attacker achieves full confidentiality, integrity, and availability compromise of the affected system, as reflected in the CVSS 3.1 score of 7.8 (High) with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity makes this a credible local privilege escalation path on POWER-architecture infrastructure.

Remote code execution in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1, stems from a stack-based buffer overflow (CWE-787) that a remote attacker can trigger to run arbitrary code with no authentication or user interaction, per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) scoring 9.8 Critical. IBM PSIRT is the reporting source. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the unauthenticated network-facing nature makes it a high-priority patching target for AIX and VIOS operators.

Denial of service via uncontrolled recursion affects IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1, enabling a remote unauthenticated attacker to crash affected systems with no authentication or user interaction required. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects low attack complexity and a fully network-exploitable path, making opportunistic or targeted disruption feasible against any exposed instance. IBM has released a patch via its support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.

Remote denial-of-service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows unauthenticated network attackers to crash affected systems via a buffer overflow. The flaw is classified as CWE-787 (out-of-bounds write), enabling complete availability impact with no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.

Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a use-after-free (CWE-416) that a network-based attacker can trigger without authentication or user interaction, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). Successful exploitation yields full compromise of confidentiality, integrity, and availability (CVSS 9.8). IBM has released a fix and there is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Information disclosure and denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 arise from a kernel heap over-read that a remote attacker can trigger without authentication or user interaction. Successful exploitation leaks sensitive kernel memory contents and can crash the affected system, and the CVSS 9.1 rating reflects the combined high confidentiality and availability impact. No public exploit has been identified at time of analysis, and the EPSS probability is low (0.34%).

Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a classic buffer overflow (CWE-120). The flaw carries a CVSS 9.8 with a network, no-authentication, no-interaction vector, meaning a successful exploit yields full compromise of the affected Unix host. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but a vendor patch is available.

Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 stems from improper certificate validation (CWE-295), allowing a remote attacker to execute arbitrary code without authentication. Because the flawed TLS/certificate trust check can be abused over the network, an attacker positioned to intercept or impersonate a trusted endpoint could deliver a malicious payload to the affected component. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.32%), but the CVSS 9.8 rating and unauthenticated network vector make this a high-priority patch on affected enterprise UNIX systems.

NULL pointer dereference in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a local low-privileged attacker to crash the system, causing a denial of service. Exploitation requires high attack complexity, suggesting a race condition or specific system state must be induced. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog; a vendor patch is available via IBM support.

Out-of-bounds read in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables local low-privileged attackers to either extract sensitive memory contents or crash the system, producing a denial of service. The flaw (CWE-125) requires only a standard local user account with no additional configuration, making it relevant to any multi-tenant AIX or VIOS deployment where untrusted users share system access. No public exploit code exists and EPSS sits at 0.15% (5th percentile), and SSVC confirms no known active exploitation at time of analysis.

Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a heap buffer overflow (CWE-787, out-of-bounds write). The CVSS 3.1 base score is 9.8 with a network vector and no privileges or user interaction required, but there is no public exploit identified at time of analysis and EPSS estimates only a 0.32% 30-day exploitation probability. IBM has published an advisory and a patch is available from the vendor.

Out-of-bounds memory write in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker corrupt process memory to compromise system confidentiality and integrity, but not availability, per the CVSS 9.1 vector. IBM has published a fix (support advisory node/7283858), and there is no public exploit identified at time of analysis. EPSS is low at 0.43% (36th percentile) and CISA SSVC records no observed exploitation, so this is a vendor-disclosed memory-corruption issue rather than a mass-exploited one.

Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a network-based attacker to run arbitrary code by bypassing authentication (CWE-287). The CVSS 9.8 rating reflects unauthenticated network exploitation with total confidentiality, integrity, and availability impact, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV. IBM has released a fix, and the moderate EPSS score (0.69%, 50th percentile) suggests exploitation is plausible but not yet widespread.

Arbitrary command execution on IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 is achievable by a local attacker through improper privilege management (CWE-269), yielding full confidentiality, integrity, and availability compromise of the affected system. The vulnerability carries a CVSS 7.8 HIGH score with a local attack vector, no prior privileges required, and a user interaction dependency. No public exploit code has been identified at time of analysis; a vendor-released patch is available via IBM's support advisory.

Arbitrary code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is enabled by an integer underflow that triggers an out-of-bounds memory write, allowing a local low-privileged attacker to execute code with elevated or host-level impact. The CVSS Scope:Changed metric indicates exploitation may allow breakout beyond the initially compromised component - particularly significant in PowerVM VIOS, where a VIOS partition compromise could affect the underlying hypervisor or other hosted LPARs. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available.

Local privilege escalation in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables any low-privileged authenticated user to achieve full system compromise through improper symbolic link handling. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms complete confidentiality, integrity, and availability impact with no user interaction required. No public exploit identified at time of analysis; a vendor patch has been released via IBM advisory https://www.ibm.com/support/pages/node/7283858.

Privilege escalation in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a local low-privileged attacker to gain elevated system access by exploiting improper symbolic link resolution (CWE-59). The CVSS 7.8 High score reflects full confidentiality, integrity, and availability impact on successful exploitation, though the local attack vector (AV:L) and low EPSS of 0.17% (7th percentile) substantially constrain real-world risk. No public exploit or active exploitation has been identified at time of analysis, and IBM has released a patch via its support portal.

Symlink following vulnerability in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 allows a local low-privileged attacker to cause a denial of service - and potentially file corruption - through improper symbolic link validation (CWE-59). The CVSS vector (AV:L/AC:H/PR:L/I:H/A:H) indicates exploitation requires local access, a race-condition timing window, and results in both high integrity and availability impact despite the DoS classification. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; IBM has released a patch.

Kernel memory disclosure in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows a local attacker with standard user privileges to read sensitive out-of-bounds kernel memory via an unspecified vulnerability. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a local shell account with no elevated rights, making it viable for any authenticated local user or a compromised service account. No public exploit code has been identified at time of analysis, and IBM has released a patch via the vendor advisory.

Sensitive information disclosure affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 via improper authentication (CWE-287), allowing unauthenticated remote attackers to obtain confidential data over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction, making it trivially reachable from any network-adjacent position. No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE, but the automatable SSVC classification means scripted, mass-scanning attacks are plausible once a technique is known.

IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 expose sensitive information over the network, enabling remote unauthenticated attackers to intercept in-flight messages and forge replies. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials or user interaction, making any network-adjacent attacker a potential threat. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; IBM has released a patch.

Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables remote unauthenticated attackers to crash affected systems by sending crafted network input, resulting in a denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates straightforward network-reachable exploitation with no privilege or user interaction required. No public exploit code has been identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog.

Uncontrolled resource consumption in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1, enables a local low-privileged attacker to exhaust system resources and trigger a denial of service condition. The vulnerability is classified under CWE-400 and carries a CVSS 3.1 base score of 5.5 with a local attack vector requiring low privileges. IBM has released a patch via advisory 7283858; no active exploitation or public proof-of-concept code has been identified at time of analysis.

Heap-based buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables a local authenticated attacker with high privileges to execute arbitrary code on affected systems. The vulnerability is rooted in improper memory management (CWE-787) and carries a CVSS 3.1 score of 6.7, reflecting the local access requirement and elevated privilege prerequisite that constrain real-world exploitability. IBM has released a patch via its support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.

Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 via heap buffer overflow (CWE-787) enables an authenticated local attacker with standard user-level access to gain elevated - potentially root - privileges on affected systems. The CVSS 7.8 High score reflects full confidentiality, integrity, and availability impact despite the local attack vector, making this a serious insider-threat and post-compromise escalation risk. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.

Stack-based buffer overflow in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 enables a local low-privileged attacker to execute arbitrary code, achieving full system compromise (C:H/I:H/A:H). The attack requires only a local account with standard user privileges and no user interaction, making post-authentication lateral movement or privilege escalation a realistic threat in IBM Power-based enterprise environments. No public exploit identified at time of analysis, but a vendor-released patch is available.

Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables a local low-privileged attacker to execute arbitrary code, achieving full confidentiality, integrity, and availability compromise of the affected system. The CVSS score of 7.8 reflects the high post-exploitation impact despite the local attack vector requirement. No public exploit has been identified at time of analysis, and SSVC confirms no known exploitation activity, though the vendor has released a patch.

Heap-based buffer overflow in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 enables a local, low-privileged attacker to execute arbitrary code, achieving full compromise of confidentiality, integrity, and availability. The vulnerability stems from unsafe memory writes (CWE-787) that corrupt heap structures at runtime. No public exploit code or active exploitation has been identified at time of analysis, and IBM has released a patch via the advisory at ibm.com/support/pages/node/7283858.

Local privilege escalation in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows a low-privileged local user to gain elevated-likely root-level-access through improper privilege management (CWE-269). The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N) reflects low-complexity exploitation requiring only a standard local account with no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though IBM has released a patch via their support portal.

Local code execution via buffer overflow affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1, allowing a low-privileged local attacker to execute arbitrary code with a scope change that can compromise components beyond the initially vulnerable boundary. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C) indicates exploitation requires only a local shell with standard user privileges and no interaction, yet the scope change elevates the impact to full CIA triad compromise. No public exploit identified at time of analysis, and a vendor-released patch is available from IBM.

Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 allows a low-privileged local attacker to gain elevated - potentially root-level - privileges by winning a time-of-check to time-of-use (TOCTOU) race condition. The vulnerability carries a CVSS 7.0 score reflecting high attack complexity due to the inherent timing constraints of race condition exploitation, though successful exploitation yields total CIA impact (full system compromise). No public exploit code has been identified and CISA SSVC classifies exploitation status as none, consistent with the extremely low EPSS score of 0.12%.

Privilege escalation via heap-based buffer overflow affects IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1, enabling a local attacker with standard user-level access to gain elevated - potentially root-level - privileges on the affected system. The CVSS scope-changed (S:C) rating confirms that successful exploitation extends control beyond the attacker's initial security context, threatening the entire host including virtual machine management infrastructure on PowerVM. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory node 7283858.

Arbitrary OS command execution via ODMDIR environment variable manipulation affects IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1, enabling local authenticated users to escalate privileges beyond their initial access boundary. The CVSS scope change (S:C) indicates that successful exploitation can compromise components outside the immediate process context - a critical concern for AIX systems hosting sensitive workloads. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but a vendor patch is available through IBM's support portal.

Denial of service via heap-based buffer overflow affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1, exploitable by remote unauthenticated attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making this a low-friction remote availability attack against IBM Power Systems infrastructure. No active exploitation or public exploit code has been identified at time of analysis; a vendor patch is available via IBM's support portal.

Local privilege escalation in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables a low-privileged local attacker to gain root access by winning a time-of-check to time-of-use (TOCTOU) race condition. The attack requires local access and precise timing, reflected in the AC:H CVSS metric, which meaningfully constrains practical exploitability. No public exploit or active exploitation is identified; EPSS sits at 0.12% (2nd percentile), consistent with the SSVC 'Exploitation: none' classification, though SSVC also rates technical impact as total given that successful exploitation yields full root control.

Arbitrary file overwrite in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker corrupt or replace files on the host due to improper neutralization of special elements in input (CWE-73). The CVSS 3.1 base score is 9.1 (I:H/A:H, no confidentiality impact), reflecting integrity and availability damage without data disclosure. No public exploit identified at time of analysis, but IBM has published a fix, and the network/low-complexity/no-privileges vector makes this a high-priority patch for exposed AIX and VIOS management interfaces.

Privilege escalation on IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows any low-privileged local user to gain full system control by exploiting improper authorization checks (CWE-285). SSVC rates the technical impact as total, consistent with the CVSS C:H/I:H/A:H rating, meaning a successful attacker achieves complete compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and EPSS at 0.13% (3rd percentile) reflects negligible current exploitation pressure, though the low attack complexity makes this a meaningful insider-threat or post-compromise escalation risk.

Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is achievable by unauthenticated remote attackers who send crafted IPsec packets that trigger an integer underflow (CWE-191) during decapsulation, causing an improper memory offset calculation that crashes the affected system. The CVSS vector confirms network-accessible, zero-authentication exploitation with low complexity, yielding a full availability impact with no confidentiality or integrity exposure. IBM has released a patch; no public exploit code or CISA KEV listing exists at time of analysis.