IBM
Monthly
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 stems from a stack-based buffer overflow that a remote attacker can trigger without authentication, per IBM PSIRT (CVE-2026-16913). With a CVSS 3.1 base of 9.8 (AV:N/AC:L/PR:N/UI:N) and full CIA impact, successful exploitation yields arbitrary code execution on the affected UNIX operating system or virtualization I/O server. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the network-reachable, unauthenticated profile makes this a high-priority patch.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows remote authenticated attackers to execute arbitrary code on affected systems. The flaw (CWE-121) is reachable over the network with low attack complexity and requires only low-privilege credentials, yielding complete confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the 8.8 CVSS score and confirmed RCE potential make patching urgent for organizations running IBM POWER infrastructure.
Remote code execution in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 is enabled by an off-by-one wrap-around error in bounds checking, reachable from an adjacent network without authentication. An attacker positioned on the same network segment can trigger the flaw to achieve full compromise of the affected system - confidentiality, integrity, and availability are all rated High. No public exploit or CISA KEV listing has been identified at time of analysis, but the combination of no-auth adjacency and RCE impact makes this a high-priority patch target in any environment running these IBM platforms.
Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 lets an unauthenticated adjacent-network attacker corrupt memory to achieve arbitrary code execution or crash the affected service (denial of service). The CVSS 3.1 base score is 9.6 (Critical) with a changed scope, reflecting potential impact beyond the vulnerable component on IBM Power hardware. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
Out-of-bounds write in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables an unauthenticated attacker positioned on an adjacent network segment to execute arbitrary code with full confidentiality, integrity, and availability impact. The CWE-787 class flaw requires no privileges and no user interaction, lowering the exploitation bar substantially once network adjacency is achieved. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of zero-prerequisite exploitation and complete system compromise warrants urgent patching in affected enterprise environments.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a stack-based buffer overflow that a network-based attacker can trigger without authentication or user interaction, per the CVSS 9.8 vector. Successful exploitation yields full compromise (high confidentiality, integrity, and availability impact) of Unix systems that frequently underpin enterprise and mission-critical workloads. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.
IBM PowerVM Hypervisor across four active firmware release trains is vulnerable to arbitrary Hostboot memory read and write via the FSP service processor mailbox interface, enabling compromise of the entire host firmware boot stack and the hypervisor subsequently loaded from it. An authenticated attacker holding FSP service-level credentials can send a specially crafted mailbox message that triggers an out-of-bounds memory operation (CWE-125), achieving full confidentiality, integrity, and availability impact against the managed POWER-series system. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the scope change to the hypervisor layer makes this a critical risk for IBM POWER environments with shared or exposed FSP credentials.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an unauthenticated remote attacker to run arbitrary code by triggering a stack-based buffer overflow, per the vendor-assigned CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N. IBM (the reporting party) has published a fix, and no public exploit identified at time of analysis. EPSS and KEV signals were not provided, so the 9.8 CVSS score is currently the strongest available severity indicator.
IBM PowerVM Hypervisor across four firmware trains (FW950 through FW1120) exposes an integer overflow (CWE-190) in its hypervisor call interface that permits a guest partition root user to inject arbitrary quantities of data into hypervisor or co-resident partition memory. The scope change (S:C in CVSS) reflects that exploitation crosses the guest-hypervisor isolation boundary, enabling either a full platform re-IPL that terminates every co-hosted partition or silent corruption of hypervisor and partition memory. No public exploit has been identified at time of analysis, and IBM has released patches covering all affected firmware trains.
Remote OS command injection in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a network attacker to execute arbitrary operating-system commands due to improper neutralization of special elements (CWE-78). The CVSS 3.1 base score is 9.8 with a network, no-privilege, no-interaction vector, and IBM has published a fix. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the combination of unauthenticated remote code execution on enterprise UNIX and virtualization infrastructure makes this a high-priority patch.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables remote authenticated attackers to execute arbitrary code, achieving full compromise of confidentiality, integrity, and availability. The CVSS 8.8 score reflects low-complexity network exploitation requiring only low-privilege authentication (PR:L), making it accessible to any credentialed user on the system. No public exploit identified at time of analysis, but a vendor-released patch is available from IBM.
Shell metacharacter injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a local low-privileged attacker to execute arbitrary OS commands, resulting in complete confidentiality, integrity, and availability compromise per CVSS C:H/I:H/A:H. The root cause (CWE-78) is insufficient sanitization of special shell characters passed to an OS interpreter within an IBM-provided utility or script. IBM has released a patch; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Local privilege escalation in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables a low-privileged authenticated user to gain root access by bypassing RBAC role enforcement. The flaw (CWE-269: Improper Privilege Management) means the operating system fails to correctly enforce the boundaries between assigned RBAC roles, allowing a standard user to assume or exercise privileges reserved for root. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from an out-of-bounds write (CWE-787) that allows a low-privileged local attacker to achieve complete system compromise across confidentiality, integrity, and availability. The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) reflects low-complexity exploitation requiring only a standard local account - a realistic threshold for insider threats or post-exploitation lateral movement within IBM Power environments. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; however, the total C/I/A:H impact on high-value enterprise Unix systems warrants prompt patching.
Remote code execution in IBM PowerVM Hypervisor partition firmware exposes Power Systems environments during network boot operations. An unauthenticated attacker positioned on the same adjacent network as a partition actively performing a network boot can send a malformed packet that triggers a CWE-787 out-of-bounds write, executing arbitrary code within the partition firmware and compromising everything the partition subsequently loads. Impact is scoped to the actively booting partition - other partitions and the managed system are explicitly unaffected. No public exploit or CISA KEV listing exists at time of analysis; EPSS is notably low at 0.19% (9th percentile), consistent with the narrow exploitation window.
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 stems from a stack-based buffer overflow (CWE-121) that a network attacker can trigger without authentication or user interaction. Because the flaw carries a CVSS 9.8 with an AV:N/AC:L/PR:N/UI:N vector, a successful attack yields full compromise of confidentiality, integrity, and availability on affected enterprise UNIX hosts and virtualization I/O servers. There is no public exploit identified at time of analysis, and IBM (the reporter) has released a fix.
Local arbitrary code execution in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 stems from improperly scrubbed environment variables (CWE-426: Untrusted Search Path), allowing a low-privileged local user to inject malicious values such as PATH or LD_PRELOAD that are subsequently consumed by a privileged process. With a CVSS score of 7.8 (HIGH) and full confidentiality, integrity, and availability impact, successful exploitation yields arbitrary code execution at an elevated privilege level. No public exploit or CISA KEV listing has been identified at time of analysis, though a vendor patch is available via IBM support.
Command injection in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables an unauthenticated attacker with adjacent network access to execute arbitrary OS commands, achieving full compromise of confidentiality, integrity, and availability. The adjacent-network attack vector (AV:A) limits exposure to attackers already positioned on the same local network or VLAN as the affected system, which is a meaningful constraint in typical enterprise deployments of these platforms. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis; IBM has released a patch via its support portal.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker overflow a stack buffer (CWE-787 out-of-bounds write) and run arbitrary code on the affected Power-based host. The flaw was reported by IBM, carries a critical 9.8 CVSS rating with a network, no-privilege, no-interaction vector, and a vendor patch is available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a stack buffer overflow (CWE-787) that a network-based attacker can trigger without authentication or user interaction, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). IBM has published a fix, and no public exploit has been identified at time of analysis, though the 9.8 base score reflects full compromise of confidentiality, integrity, and availability. The exact vulnerable service/daemon is not disclosed in the available data, which limits precise attack-surface scoping.
Remote unauthenticated manipulation of network traffic and DNS configuration is possible in IBM AIX 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1, due to improper authentication controls (CWE-287). The CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no user interaction, and no special network positioning - making this accessible to any remote attacker with TCP connectivity to an affected system. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed, but the low attack complexity and high integrity impact make this a meaningful priority for IBM Power Systems environments.
Remote denial of service in IBM AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1 allows an unauthenticated network attacker to crash affected systems by triggering an integer overflow in a network-reachable component. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector confirms full availability loss with no authentication or user interaction required. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog; however, the low attack complexity means opportunistic exploitation is feasible once technical details become public.
Denial of service via use-after-free in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an unauthenticated attacker on an adjacent network to crash affected systems by triggering a memory corruption condition. The scope change (S:C) in the CVSS vector is significant in virtualization contexts: a successful attack against PowerVM VIOS could cascade to hosted virtual machines, amplifying the availability impact beyond the directly targeted component. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is achievable by an unauthenticated attacker on the same network segment via command injection triggered by crafted IPv6 Router Advertisement messages. The vulnerability (CWE-269, Improper Privilege Management) implies the RA processing subsystem executes injected commands with elevated OS-level privileges, enabling full confidentiality, integrity, and availability compromise of the affected host. No public exploit has been identified at time of analysis; IBM has released a patch per advisory https://www.ibm.com/support/pages/node/7283858.
Stack-based buffer overflow in IBM PowerVM Hypervisor's host firmware configuration parsing allows authenticated service-level access holders to crash the firmware boot stack with possible memory corruption during system initialization, impacting integrity and availability of the managed Power system. Affected firmware spans three release trains: FW1060.00-FW1060.80, FW1110.00-FW1110.30, and FW1120.00. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; IBM has released a patch via advisory at https://www.ibm.com/support/pages/node/7283238.
Arbitrary command execution against IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 is possible by an unauthenticated attacker on the same network segment who can deliver DHCP option values containing unescaped shell metacharacters to the system's DHCP client. The DHCP client fails to neutralize these metacharacters before passing option data to shell processing (CWE-78), enabling full confidentiality, integrity, and availability compromise of the target host. A vendor patch is available via IBM support, and no public exploit or CISA KEV listing has been identified at time of analysis.
Network boot exploitation in IBM PowerVM Hypervisor across firmware branches FW950, FW1060, FW1110, and FW1120 allows an unauthenticated attacker with adjacent-network access to disrupt or hijack the boot sequence of any partition performing a PXE/network boot. Under the default configuration where OS secure boot is disabled, the attacker can substitute the boot image entirely, compromising the OS and all subsequently loaded software for that partition. No active exploitation has been confirmed per SSVC and EPSS signals, but the default-configuration exposure and full partition compromise potential make this a meaningful priority for IBM Power Systems operators.
Heap buffer overflow in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 enables unauthenticated adjacent-network attackers to execute arbitrary code on affected systems. The CWE-787 out-of-bounds write flaw carries a CVSS score of 8.8 and yields full confidentiality, integrity, and availability compromise upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis; however, a vendor-supplied patch is available via IBM support advisory node/7283858.
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a heap buffer overflow (CWE-787 out-of-bounds write) in an affected network-facing component. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated, low-complexity network exploitation with full confidentiality, integrity, and availability impact. IBM has published a fix; no public exploit identified at time of analysis and no CISA KEV listing, so this is currently a high-severity but not confirmed-exploited issue.
OS command injection in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables an unauthenticated attacker with adjacent network access to execute arbitrary operating system commands without any user interaction. The flaw (CWE-78) resides in a network-exposed component that fails to neutralize shell metacharacters before incorporating user-supplied input into OS commands, granting full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, but a vendor patch is available via IBM support advisory.
OS command injection in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 allows an adjacent network attacker without credentials to execute arbitrary operating system commands. The flaw (CWE-78) arises from improper neutralization of special elements passed to OS command constructors, exposing the full confidentiality, integrity, and availability of affected hosts. No public exploit or CISA KEV listing has been identified at time of analysis, though a vendor patch is available via IBM Support.
Stack buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables unauthenticated remote code execution by any attacker with adjacent network access. The flaw (CWE-787, Out-of-bounds Write) corrupts stack memory during processing of a crafted network payload, allowing an attacker to overwrite return addresses and redirect execution without requiring credentials or user interaction. No public exploit has been identified at time of analysis and IBM has released a patch, but the AV:A/PR:N/AC:L vector makes this a high-priority fix for any organization running IBM Power Systems infrastructure.
Remote code execution in IBM PowerVM Hypervisor firmware versions FW950 through FW1120 allows an attacker with authenticated service-level access to the Flexible Service Processor (FSP) to execute arbitrary code in the host firmware runtime and gain full control of the managed Power system. An integer overflow (CWE-190) in the service processor mailbox interface is the root cause, with CVSS scope change (S:C) reflecting that exploitation breaks out from the FSP boundary into the broader host firmware and managed-system context. No public exploit or CISA KEV listing exists at time of analysis; however, the combination of complete C/I/A impact and scope change makes this a high-priority patch target for any organization running affected IBM Power hardware.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering an out-of-bounds write (CWE-787) in an affected component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates the flaw is reachable over the network by unauthenticated attackers with low complexity, yielding full compromise of confidentiality, integrity, and availability. IBM has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote information disclosure in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from an integer underflow in the kernel's IPv4 IP-options parser (CWE-125 out-of-bounds read), letting a remote attacker leak sensitive memory contents by sending crafted IP packets. IBM (the reporting vendor) rates it CVSS 9.4, and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
TOCTOU race condition in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 permits a local, low-privileged user to overwrite critical system files or extract sensitive information by exploiting the timing gap between a file-check and file-use operation. The attack is constrained to local access with high exploitation complexity, yet the potential impact spans full confidentiality, integrity, and availability compromise of the affected system. No public exploit or CISA KEV listing exists at time of analysis; IBM has released a vendor patch.
Remote denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows unauthenticated network attackers to crash or exhaust resources in the SSL subsystem by omitting an expected client certificate during the TLS handshake. The CVSS 7.5 rating (AV:N/AC:L/PR:N/UI:N) confirms low attack complexity with no authentication required, making exploitation straightforward against any exposed SSL service on affected systems. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the patch is available and should be prioritized for internet-facing AIX and VIOS deployments.
Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables unauthenticated remote attackers to exhaust system resources via network-delivered input, fully disabling availability (CVSS A:H) without any confidentiality or integrity impact. The vulnerability is rooted in CWE-400 uncontrolled resource consumption, triggered from the network with no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N). No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available from IBM.
Denial of service in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker crash or hang the affected system by triggering an integer underflow (CWE-190) in a network-reachable component. The flaw was reported by IBM, which has released a fix; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. Note that IBM's published CVSS 9.8 claims full confidentiality/integrity/availability impact, which conflicts with the description's DoS-only wording.
Denial of service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 allows unauthenticated remote attackers to exhaust system resources and render affected systems unavailable by sending crafted network input that triggers uncontrolled resource consumption (CWE-400). The CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms low-complexity, unauthenticated remote exploitability with a high availability impact. No active exploitation has been confirmed in CISA KEV, and no public exploit code is known at time of analysis; a vendor patch is available via IBM's support portal.
Unbounded recursion in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 exposes these systems to remote denial-of-service attacks requiring no authentication or user interaction. Network-reachable attackers can trigger uncontrolled resource consumption, exhausting stack or memory resources and disrupting availability of affected systems. No public exploit code has been identified and CISA KEV does not list this vulnerability; a vendor-released patch is available via IBM's support portal.
TNC policy server impersonation in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a network-positioned attacker forge the Trusted Network Connect policy server and tamper with the traffic between it and the endpoint, because the client fails to properly validate the server's certificate (CWE-295). An attacker who can intercept the session can present a fraudulent certificate, read limited data and alter integrity-critical policy exchanges. IBM has released a fix; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Full host-system memory access in IBM Power Systems Firmware allows a privileged BMC/FSP attacker to read and write arbitrary regions of host memory, yielding complete control over the host and all hosted logical partitions. Affected firmware spans multiple generations including FW1120.00, FW1110.x, FW1060.x, FW950.x, and OP940.x lines covering Power9 and Power HMC platforms. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, though the scope-changing impact (S:C) and full C/I/A triad make this a critical priority for any environment where BMC/FSP access is not tightly controlled.
Memory corruption and persistent denial-of-service in IBM Power Systems Firmware exposes OpenPOWER environments to host-level crashes triggered from guest partitions. An attacker holding root access within a guest partition can write a specially crafted NVRAM image that causes the host firmware boot stage to crash with possible memory corruption, taking down the managed system until an operator manually clears NVRAM via the service processor. No public exploit code has been identified and no active exploitation is confirmed, but the persistence of the availability impact and the cross-boundary scope change (guest-to-host) make this a meaningful risk in shared multi-tenant OpenPOWER environments.
IBM Power Systems Firmware across three firmware branches exposes a privilege escalation path across the BMC/FSP-to-host boundary, allowing an attacker already holding service account or root credentials on the Flexible Service Processor to read and disrupt host processor state, cascading impact to all logical partitions (LPARs) hosted on the managed system. The scope change confirmed in the CVSS vector (S:C) distinguishes this from a typical local privilege issue: exploitation crosses the management-plane isolation barrier and can affect production workloads running on every partition. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Remote code execution in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950.H2) lets an unauthenticated attacker with adjacent-network access to the ASMI web interface send a malformed request that overflows a stack buffer on the Flexible Service Processor (FSP), yielding arbitrary code execution and full control of the managed system. Because the FSP is the service processor beneath the OS, compromise crosses a scope boundary (CVSS S:C) and breaks confidentiality, integrity, and availability of the whole platform. No public exploit identified at time of analysis; IBM has released a fix and reported the issue itself.
Authentication bypass in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950.H2) lets an unauthenticated attacker positioned on the Flexible Service Processor (FSP) management network assume full administrative control of the managed system. An attacker can manipulate partition power state, alter configuration, and access partition consoles across every hosted LPAR, yielding complete confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the flaw is not on CISA KEV, but the 9.6 CVSS and scope-changing impact make it a high-priority patch for datacenters running IBM Power hardware.
Remote code execution in IBM Power Systems Firmware is possible via a stack-based buffer overflow (CWE-121) in the FSP management network protocol. An attacker holding authenticated HMC administrator credentials and adjacent-network access to the management interface can trigger the overflow to execute arbitrary code on the Flexible Service Processor, achieving full out-of-band control over all managed hardware and hosted workloads. No public exploit code and no CISA KEV listing are confirmed at time of analysis; the vendor has released a patch.
Cross-site request forgery in IBM Power Systems Firmware's ASMI web interface allows a network-based attacker to silently execute arbitrary administrative actions against the Flexible Service Processor (FSP) by tricking a logged-in ASMI administrator into visiting a crafted page. Affected versions span four major firmware branches - FW950, FW1060, FW1110, and FW1120 - covering a broad range of IBM Power hardware in production. No public exploit identified at time of analysis, though the high integrity and availability impact against firmware-level management infrastructure makes this a significant risk for affected organizations.
Unauthenticated crash and possible memory corruption in the IBM Power Systems ASMI web interface exposes multiple firmware release trains (FW950, FW1060, FW1110, FW1120) to repeated denial of out-of-band management access. An attacker present on the management network can trigger ASMI web server crashes without credentials, and sustained repeated exploitation can lock administrators out of the ASMI interface entirely - though hosted logical partitions remain unaffected. No public exploit code has been identified at time of analysis, and IBM has issued a patch via advisory 7283898.
Arbitrary code execution on IBM Power Systems host environments is achievable by an attacker with service-level access to the Baseboard Management Controller (BMC), exploiting a stack-based buffer overflow (CWE-121) in the BMC-to-host communication interface. Affected firmware versions FW1120.00 and FW1110.00 through FW1110.30 are vulnerable; successful exploitation yields full control over the host system and all hosted logical partitions (LPARs), resulting in complete confidentiality, integrity, and availability compromise across all co-located workloads. No public exploit has been identified at time of analysis, and the CVE is not currently listed in the CISA KEV catalog; IBM has released a remediation patch via advisory at https://www.ibm.com/support/pages/node/7283220.
Full takeover of IBM Power Systems host partitions and all hosted logical partitions (LPARs) is achievable by any actor holding service account or root credentials on the BMC or FSP management controller across multiple IBM Power firmware generations. The flaw (CWE-863, Incorrect Authorization) permits writing arbitrary data to hardware control registers via the BMC/FSP-to-host interface, collapsing the security boundary between the out-of-band management plane and every workload running on the system. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV; IBM has released a firmware patch via support advisory 7283218.
Arbitrary code execution on IBM Power Systems host is achievable by any attacker who already holds service account or root access to the BMC or FSP management controller. The vulnerability resides in the interface layer between the BMC/FSP and the host, where missing authorization checks (CWE-862) allow an authenticated BMC-level principal to cross the trust boundary and execute code with full host-system privileges. All hosted logical partitions are consequently exposed, making this a critical lateral-movement and privilege-escalation path within IBM Power infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in IBM Power Firmware's host firmware configuration parser allows an attacker with service-level access to the BMC/FSP to supply specially crafted configuration data, triggering CWE-121 during the firmware boot stage and compromising the entire software stack loaded thereafter. Affected firmware spans multiple major release trains - FW1120, FW1110, FW1060, FW950, and OP940 - covering Power9 and Power HMC managed systems. No public exploit has been identified at the time of analysis, and a vendor patch is available from IBM.
Arbitrary code execution in IBM Power Firmware across multiple firmware branches (FW1120.00, FW1110.x, FW1060.x, FW950.x, OP940.x) stems from a CWE-787 out-of-bounds write in the service processor mailbox interface. An authenticated attacker with service-level access to the BMC/FSP can exploit this buffer overflow to cross the trust boundary from the management processor into the host firmware runtime, gaining full control over the managed Power system. No public exploit has been identified at time of analysis; IBM has released a patch per advisory 7283236.
Arbitrary code execution on IBM Power host systems is possible when an attacker with service processor access supplies a maliciously crafted firmware update image that bypasses boot-time image validation. Affected firmware versions span three release trains: FW1120.00, FW1110.00-FW1110.30, and FW1060.00-FW1060.80. Exploitation yields full confidentiality, integrity, and availability impact on the host, with scope change indicating the compromise extends beyond the service processor itself. No public exploit or CISA KEV listing is identified at this time.
Unauthenticated remote attackers can overwrite administrator email addresses and abuse IBM Langflow OSS as an outbound mail relay by exploiting a missing authentication control on the registration endpoint, affecting versions 1.0.0 through 1.10.0. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms trivially reachable exploitation with no credentials or user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this viable for opportunistic exploitation once the endpoint is discovered.
IBM AIX 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, expose a time-of-check time-of-use (TOCTOU) race condition that local, unprivileged attackers can exploit to corrupt data integrity or crash the system. The flaw requires only local shell access with no privileges, making it exploitable by any local user account on affected POWER-architecture systems. No public exploit code or CISA KEV listing exists at time of analysis, though a vendor patch is available.
Uncontrolled resource consumption in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 exposes these systems to remote denial-of-service attacks requiring no authentication or user interaction. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms any network-reachable attacker can trigger availability loss without special privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and a vendor patch is available.
IBM AIX 7.2 and 7.3, and PowerVM VIOS 4.1 expose an unauthenticated remote denial-of-service condition rooted in a NULL pointer dereference. A remote attacker with no credentials or user interaction can crash affected network-accessible components, resulting in complete availability loss (A:H) with no confidentiality or integrity impact. No public exploit code or active exploitation has been confirmed at time of analysis, and IBM has released a patch via advisory https://www.ibm.com/support/pages/node/7283858.
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute arbitrary operating-system commands due to improper neutralization of special elements (CWE-78). Rated CVSS 9.9 with a scope change, a successful low-privilege attacker can break out of the application context and run commands on the underlying enterprise Unix host, threatening confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and network reachability make it a high-priority patch.
Heap buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables unauthenticated remote code execution by attackers positioned on an adjacent network segment, with no user interaction required. The flaw (CWE-787, out-of-bounds write) results in full compromise of confidentiality, integrity, and availability of the affected system. A vendor patch has been released via IBM advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote denial-of-service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 is caused by a CWE-787 out-of-bounds write reachable by unauthenticated network attackers with no complexity prerequisites. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects straightforward remote triggering with high availability impact but no confidentiality or integrity consequence. IBM has released a patch via the vendor advisory; no public exploit code has been identified at time of analysis.
Local privilege escalation in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows an authenticated low-privileged user to gain full elevated privileges due to improper privilege management (CWE-269). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that any standard local user account is sufficient to trigger the flaw with low complexity and no user interaction, resulting in complete confidentiality, integrity, and availability compromise of the affected system. No public exploit identified at time of analysis, and a vendor patch is available via IBM advisory.
Remote denial-of-service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables an unauthenticated network attacker to exhaust system resources and crash or severely degrade affected hosts. The root cause is uncontrolled resource consumption (CWE-400), exploitable without authentication or user interaction via a network-accessible service. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch addressed in advisory node/7283858.
Unauthenticated remote access to NFS-exported filesystems is possible in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 due to improper authentication (CWE-287). The CVSS vector AV:N/AC:L/PR:N/UI:N confirms that unauthenticated remote attackers on the network can exploit this with low complexity and no user interaction, gaining high-confidence read access and limited write access to exported filesystem data. No public exploit has been identified at time of analysis, and IBM has released a patch via advisory 7283858.
Remote denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is exploitable by unauthenticated attackers who send malformed client registration packets to the NIM (Network Installation Manager) server, triggering a classic buffer overflow that crashes the nimserver daemon. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms low-complexity, network-accessible exploitation requiring no privileges, though impact is strictly limited to availability - no confidentiality or integrity exposure is present. IBM has released a patch via support advisory 7283858; no public exploit code has been identified and this vulnerability does not appear on the CISA KEV catalog at time of analysis.
Remote privilege escalation to root in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 stems from an improper authentication weakness (CWE-287) that lets an unauthenticated network attacker bypass identity checks and obtain root-level control. The CVSS 9.8 rating reflects a network-reachable, low-complexity flaw requiring no privileges or user interaction, with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the severity and unauthenticated network vector make it a high-priority patching target for IBM Power estates.
Improper TLS certificate validation in the NIM (Network Installation Management) subsystem of IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 enables remote attackers to gain unauthorized access to AIX systems by exploiting the failure to verify certificate authenticity during NIM communications. The CVSS 8.1 High score reflects high confidentiality and integrity impact across a network-exploitable path with low complexity and no user interaction required. No public exploit identified at time of analysis, but the authentication bypass classification of this flaw makes it a meaningful privilege escalation and lateral movement risk in IBM Power environments.
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands through the Network Installation Manager (NIM) component. Because NIM typically operates with high (often root-level) privilege and the CVSS scope is Changed, successful exploitation can compromise the underlying operating system with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the 9.9 base score and low attack complexity make it a high-priority patch for IBM Power estates.
Sensitive-key exposure in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 Network Installation Management (NIM) leaks intermediate certificate authority (CA) private keys inside a publicly downloadable update file, letting remote attackers forge trusted certificates and bypass security restrictions. Rated CVSS 9.1, the flaw impacts confidentiality and integrity (C:H/I:H) but not availability, and IBM has released a fix. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the ease of obtaining a live CA key makes this a high-priority credential-hygiene issue.
Unauthenticated remote file overwrite in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is possible via the nimesis registration service, which fails to sanitize path traversal sequences in client-supplied input. An attacker with network access to the nimesis service can write arbitrary content to locations outside the intended directory, potentially overwriting sensitive system files such as cron jobs, init scripts, or authentication databases. No public exploit or active exploitation has been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is straightforwardly exploitable without authentication.
Sensitive file disclosure in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 is possible through a path traversal flaw (CWE-22) that allows attackers to escape a restricted directory boundary and read files outside the intended accessible path, resulting in high confidentiality impact. The CVE description attributes the exposure to a remote authenticated attacker, though this conflicts with the NVD-assigned CVSS vector - a discrepancy security teams must resolve before finalizing triage. A vendor patch is available via IBM Support advisory node/7283359; no public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file deletion in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 is achievable by remote authenticated attackers holding only low-privileged credentials, exploiting a path traversal flaw that bypasses directory boundary enforcement to reference and delete files anywhere on the target filesystem. The CVSS 3.1 score of 8.1 reflects high integrity and availability impact with low attack complexity, though the EPSS score of 0.44% at the 37th percentile signals limited observed exploitation probability at time of analysis. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog.
Remote CL command execution in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 lets a remote attacker run arbitrary Control Language commands on the IBM i host because special elements in a command are not properly neutralized (CWE-78). The CVSS 3.1 base score is 9.8 with a fully network-facing, no-privilege, no-interaction vector, meaning an unauthenticated remote attacker can achieve high-impact code execution. There is no public exploit identified at time of analysis and EPSS is modest at 0.47% (39th percentile), but the combination of unauthenticated network reach and full CIA impact makes this a high-priority patch.
Remote code execution in IBM Db2 Mirror for i (versions 7.4, 7.5, and 7.6) allows a remote unauthenticated attacker to run arbitrary code by exploiting external control of a file name or path (CWE-73). The flaw carries a CVSS 9.8 rating with a network attack vector and no privileges or user interaction required, and IBM has published a fix. No public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in IBM Db2 Mirror for i (versions 7.4, 7.5, and 7.6) lets a remote, unauthenticated attacker read or modify sensitive information by exploiting improper validation of request URI path segments. Because the flaw is reachable over the network without credentials or user interaction, an attacker can defeat access controls on the replication/administration interface and reach protected functionality or data. No public exploit has been identified at time of analysis, but the maximal CVSS 9.8 rating and the low attack complexity make this a high-priority patching target.
Arbitrary file write via path traversal in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 enables remote unauthenticated attackers to place files at any location on the underlying IBM i system. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/I:H) confirms network-reachable exploitation without authentication, with a scope change indicating impact beyond the Db2 Mirror application itself - reaching OS-level paths. No public exploit or KEV listing has been identified at time of analysis, and an EPSS of 0.59% (46th percentile) suggests low observed exploitation activity despite the high CVSS base score.
Uncontrolled recursion in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote unauthenticated attackers to crash the service, resulting in a complete loss of availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is exploitable over the network without credentials or user interaction, making it trivially reachable in any internet- or network-exposed deployment. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, but the low attack complexity elevates practical risk.
Arbitrary file write via path traversal in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes systems to unauthenticated remote exploitation. The flaw stems from improper pathname restriction (CWE-22), enabling an attacker to escape the intended directory sandbox and write files to arbitrary filesystem locations. No active exploitation has been confirmed in CISA KEV, and no public proof-of-concept exploit is known at the time of analysis, though the CVSS 8.2 High rating and network-accessible attack vector make this a credible priority for organizations running IBM i environments.
Path traversal in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote authenticated attackers to read sensitive files outside intended directory boundaries due to improper input validation (CWE-22). The vulnerability results in high confidentiality impact with no integrity or availability consequence. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available via IBM support advisory node 7283359.
Security restriction bypass in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 permits remote authenticated attackers to exceed their authorized privilege level via manipulated user-supplied input processed without adequate authorization checks. With a CVSS score of 8.8 and full confidentiality, integrity, and availability impact, exploitation could allow an attacker with only low-privilege credentials to read, modify, or disrupt mirrored database content. No public exploit code and no CISA KEV listing have been identified at time of analysis, though a vendor patch is available.
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes a network-accessible pathway through which an unauthenticated remote attacker can externally influence system configuration settings (CWE-15), enabling disclosure of sensitive information and - per the CVSS vector - potential integrity and availability compromise as well. The changed scope (S:C) in the CVSS vector indicates the vulnerability can propagate impact beyond the directly affected component, consistent with how mirror configuration alterations can affect the paired IBM i high-availability node. A vendor-released patch is available via IBM Support; no public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Account takeover in IBM Langflow OSS versions 1.0.0 through 1.9.6 is possible because the platform fails to limit repeated failed authentication attempts (CWE-307), letting remote attackers brute-force or credential-stuff their way into user accounts. IBM (the reporting vendor) rates it CVSS 9.1 with high confidentiality and integrity impact, reflecting full compromise of a targeted account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the missing lockout control is trivial to abuse against weak or reused credentials.
Stack-based buffer overflow in the Native IBM i JSSE (Java Secure Socket Extension) provider enables local authenticated attackers with low privileges to execute arbitrary code or crash the JVM process on IBM i versions 7.3 through 7.6. The flaw is triggered during TLS session establishment via improper bounds checking against a fixed-length stack buffer. No public exploit or active exploitation has been identified at time of analysis - EPSS stands at 0.22% (12th percentile) and SSVC exploitation status is 'none' - but a vendor patch is available and should be applied given the high-impact code execution potential.
Privilege escalation in IBM i versions 7.3 through 7.6 allows a local authenticated attacker to abuse improper authorization controls in the Navigator for i debugger component to access or manipulate sensitive system data, or create new profiles with elevated privileges. The vulnerability is classified under CWE-285 (Improper Authorization), indicating the debugger fails to enforce sufficient privilege checks before granting access to sensitive operations. No public exploit or CISA KEV listing exists at time of analysis, though SSVC assesses the technical impact as total should exploitation occur.
Privilege escalation in IBM i (7.3, 7.4, 7.5, 7.6) lets a remote, authenticated attacker gain elevated privileges by abusing improper validation of pointers read from Java-controlled addresses, giving full compromise of the affected component and a scope-changing impact beyond it. IBM assigned a critical CVSS 9.9 (S:C) despite requiring low privileges. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none, so this is a patch-worthy critical without evidence of active abuse yet.
Security-restriction bypass in IBM i (the operating system for IBM Power servers, formerly OS/400) versions 7.3 through 7.6 lets a remote attacker abuse improper validation of user-controlled addresses to elevate privileges and cross a security boundary. Vendor scoring rates this a maximum-severity, unauthenticated network flaw (CVSS 10.0, scope-changed), though there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.33%). IBM published a fix, and CISA's SSVC framework currently marks exploitation as 'none' with a 'total' technical impact.
Thread authority swap mismanagement in IBM i 7.3 through 7.6 enables a low-privileged local attacker to gain elevated system authorities, including potentially *ALLOBJ-equivalent access. The CVSS scope change (S:C) confirms that successful exploitation extends privilege impact beyond the attacker's own user profile, threatening the broader system partition. No public exploit or active CISA KEV listing exists at time of analysis; risk is driven by low attack complexity and the critical role IBM i plays in regulated enterprise environments.
Remote denial of service via stack-based buffer overflow affects IBM i versions 7.3 through 7.6, allowing unauthenticated network attackers to crash an affected service without any user interaction or elevated privileges. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation is straightforward from the network with no special conditions, making this a reliable availability threat against exposed IBM i systems. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; however, the vendor has released a patch via the IBM support portal.
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 stems from a stack-based buffer overflow that a remote attacker can trigger without authentication, per IBM PSIRT (CVE-2026-16913). With a CVSS 3.1 base of 9.8 (AV:N/AC:L/PR:N/UI:N) and full CIA impact, successful exploitation yields arbitrary code execution on the affected UNIX operating system or virtualization I/O server. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the network-reachable, unauthenticated profile makes this a high-priority patch.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows remote authenticated attackers to execute arbitrary code on affected systems. The flaw (CWE-121) is reachable over the network with low attack complexity and requires only low-privilege credentials, yielding complete confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the 8.8 CVSS score and confirmed RCE potential make patching urgent for organizations running IBM POWER infrastructure.
Remote code execution in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 is enabled by an off-by-one wrap-around error in bounds checking, reachable from an adjacent network without authentication. An attacker positioned on the same network segment can trigger the flaw to achieve full compromise of the affected system - confidentiality, integrity, and availability are all rated High. No public exploit or CISA KEV listing has been identified at time of analysis, but the combination of no-auth adjacency and RCE impact makes this a high-priority patch target in any environment running these IBM platforms.
Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 lets an unauthenticated adjacent-network attacker corrupt memory to achieve arbitrary code execution or crash the affected service (denial of service). The CVSS 3.1 base score is 9.6 (Critical) with a changed scope, reflecting potential impact beyond the vulnerable component on IBM Power hardware. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
Out-of-bounds write in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables an unauthenticated attacker positioned on an adjacent network segment to execute arbitrary code with full confidentiality, integrity, and availability impact. The CWE-787 class flaw requires no privileges and no user interaction, lowering the exploitation bar substantially once network adjacency is achieved. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of zero-prerequisite exploitation and complete system compromise warrants urgent patching in affected enterprise environments.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a stack-based buffer overflow that a network-based attacker can trigger without authentication or user interaction, per the CVSS 9.8 vector. Successful exploitation yields full compromise (high confidentiality, integrity, and availability impact) of Unix systems that frequently underpin enterprise and mission-critical workloads. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.
IBM PowerVM Hypervisor across four active firmware release trains is vulnerable to arbitrary Hostboot memory read and write via the FSP service processor mailbox interface, enabling compromise of the entire host firmware boot stack and the hypervisor subsequently loaded from it. An authenticated attacker holding FSP service-level credentials can send a specially crafted mailbox message that triggers an out-of-bounds memory operation (CWE-125), achieving full confidentiality, integrity, and availability impact against the managed POWER-series system. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the scope change to the hypervisor layer makes this a critical risk for IBM POWER environments with shared or exposed FSP credentials.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an unauthenticated remote attacker to run arbitrary code by triggering a stack-based buffer overflow, per the vendor-assigned CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N. IBM (the reporting party) has published a fix, and no public exploit identified at time of analysis. EPSS and KEV signals were not provided, so the 9.8 CVSS score is currently the strongest available severity indicator.
IBM PowerVM Hypervisor across four firmware trains (FW950 through FW1120) exposes an integer overflow (CWE-190) in its hypervisor call interface that permits a guest partition root user to inject arbitrary quantities of data into hypervisor or co-resident partition memory. The scope change (S:C in CVSS) reflects that exploitation crosses the guest-hypervisor isolation boundary, enabling either a full platform re-IPL that terminates every co-hosted partition or silent corruption of hypervisor and partition memory. No public exploit has been identified at time of analysis, and IBM has released patches covering all affected firmware trains.
Remote OS command injection in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a network attacker to execute arbitrary operating-system commands due to improper neutralization of special elements (CWE-78). The CVSS 3.1 base score is 9.8 with a network, no-privilege, no-interaction vector, and IBM has published a fix. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the combination of unauthenticated remote code execution on enterprise UNIX and virtualization infrastructure makes this a high-priority patch.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables remote authenticated attackers to execute arbitrary code, achieving full compromise of confidentiality, integrity, and availability. The CVSS 8.8 score reflects low-complexity network exploitation requiring only low-privilege authentication (PR:L), making it accessible to any credentialed user on the system. No public exploit identified at time of analysis, but a vendor-released patch is available from IBM.
Shell metacharacter injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a local low-privileged attacker to execute arbitrary OS commands, resulting in complete confidentiality, integrity, and availability compromise per CVSS C:H/I:H/A:H. The root cause (CWE-78) is insufficient sanitization of special shell characters passed to an OS interpreter within an IBM-provided utility or script. IBM has released a patch; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Local privilege escalation in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables a low-privileged authenticated user to gain root access by bypassing RBAC role enforcement. The flaw (CWE-269: Improper Privilege Management) means the operating system fails to correctly enforce the boundaries between assigned RBAC roles, allowing a standard user to assume or exercise privileges reserved for root. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from an out-of-bounds write (CWE-787) that allows a low-privileged local attacker to achieve complete system compromise across confidentiality, integrity, and availability. The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) reflects low-complexity exploitation requiring only a standard local account - a realistic threshold for insider threats or post-exploitation lateral movement within IBM Power environments. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; however, the total C/I/A:H impact on high-value enterprise Unix systems warrants prompt patching.
Remote code execution in IBM PowerVM Hypervisor partition firmware exposes Power Systems environments during network boot operations. An unauthenticated attacker positioned on the same adjacent network as a partition actively performing a network boot can send a malformed packet that triggers a CWE-787 out-of-bounds write, executing arbitrary code within the partition firmware and compromising everything the partition subsequently loads. Impact is scoped to the actively booting partition - other partitions and the managed system are explicitly unaffected. No public exploit or CISA KEV listing exists at time of analysis; EPSS is notably low at 0.19% (9th percentile), consistent with the narrow exploitation window.
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 stems from a stack-based buffer overflow (CWE-121) that a network attacker can trigger without authentication or user interaction. Because the flaw carries a CVSS 9.8 with an AV:N/AC:L/PR:N/UI:N vector, a successful attack yields full compromise of confidentiality, integrity, and availability on affected enterprise UNIX hosts and virtualization I/O servers. There is no public exploit identified at time of analysis, and IBM (the reporter) has released a fix.
Local arbitrary code execution in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 stems from improperly scrubbed environment variables (CWE-426: Untrusted Search Path), allowing a low-privileged local user to inject malicious values such as PATH or LD_PRELOAD that are subsequently consumed by a privileged process. With a CVSS score of 7.8 (HIGH) and full confidentiality, integrity, and availability impact, successful exploitation yields arbitrary code execution at an elevated privilege level. No public exploit or CISA KEV listing has been identified at time of analysis, though a vendor patch is available via IBM support.
Command injection in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables an unauthenticated attacker with adjacent network access to execute arbitrary OS commands, achieving full compromise of confidentiality, integrity, and availability. The adjacent-network attack vector (AV:A) limits exposure to attackers already positioned on the same local network or VLAN as the affected system, which is a meaningful constraint in typical enterprise deployments of these platforms. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis; IBM has released a patch via its support portal.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker overflow a stack buffer (CWE-787 out-of-bounds write) and run arbitrary code on the affected Power-based host. The flaw was reported by IBM, carries a critical 9.8 CVSS rating with a network, no-privilege, no-interaction vector, and a vendor patch is available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a stack buffer overflow (CWE-787) that a network-based attacker can trigger without authentication or user interaction, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). IBM has published a fix, and no public exploit has been identified at time of analysis, though the 9.8 base score reflects full compromise of confidentiality, integrity, and availability. The exact vulnerable service/daemon is not disclosed in the available data, which limits precise attack-surface scoping.
Remote unauthenticated manipulation of network traffic and DNS configuration is possible in IBM AIX 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1, due to improper authentication controls (CWE-287). The CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no user interaction, and no special network positioning - making this accessible to any remote attacker with TCP connectivity to an affected system. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed, but the low attack complexity and high integrity impact make this a meaningful priority for IBM Power Systems environments.
Remote denial of service in IBM AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1 allows an unauthenticated network attacker to crash affected systems by triggering an integer overflow in a network-reachable component. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector confirms full availability loss with no authentication or user interaction required. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog; however, the low attack complexity means opportunistic exploitation is feasible once technical details become public.
Denial of service via use-after-free in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an unauthenticated attacker on an adjacent network to crash affected systems by triggering a memory corruption condition. The scope change (S:C) in the CVSS vector is significant in virtualization contexts: a successful attack against PowerVM VIOS could cascade to hosted virtual machines, amplifying the availability impact beyond the directly targeted component. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is achievable by an unauthenticated attacker on the same network segment via command injection triggered by crafted IPv6 Router Advertisement messages. The vulnerability (CWE-269, Improper Privilege Management) implies the RA processing subsystem executes injected commands with elevated OS-level privileges, enabling full confidentiality, integrity, and availability compromise of the affected host. No public exploit has been identified at time of analysis; IBM has released a patch per advisory https://www.ibm.com/support/pages/node/7283858.
Stack-based buffer overflow in IBM PowerVM Hypervisor's host firmware configuration parsing allows authenticated service-level access holders to crash the firmware boot stack with possible memory corruption during system initialization, impacting integrity and availability of the managed Power system. Affected firmware spans three release trains: FW1060.00-FW1060.80, FW1110.00-FW1110.30, and FW1120.00. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; IBM has released a patch via advisory at https://www.ibm.com/support/pages/node/7283238.
Arbitrary command execution against IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 is possible by an unauthenticated attacker on the same network segment who can deliver DHCP option values containing unescaped shell metacharacters to the system's DHCP client. The DHCP client fails to neutralize these metacharacters before passing option data to shell processing (CWE-78), enabling full confidentiality, integrity, and availability compromise of the target host. A vendor patch is available via IBM support, and no public exploit or CISA KEV listing has been identified at time of analysis.
Network boot exploitation in IBM PowerVM Hypervisor across firmware branches FW950, FW1060, FW1110, and FW1120 allows an unauthenticated attacker with adjacent-network access to disrupt or hijack the boot sequence of any partition performing a PXE/network boot. Under the default configuration where OS secure boot is disabled, the attacker can substitute the boot image entirely, compromising the OS and all subsequently loaded software for that partition. No active exploitation has been confirmed per SSVC and EPSS signals, but the default-configuration exposure and full partition compromise potential make this a meaningful priority for IBM Power Systems operators.
Heap buffer overflow in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 enables unauthenticated adjacent-network attackers to execute arbitrary code on affected systems. The CWE-787 out-of-bounds write flaw carries a CVSS score of 8.8 and yields full confidentiality, integrity, and availability compromise upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis; however, a vendor-supplied patch is available via IBM support advisory node/7283858.
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a heap buffer overflow (CWE-787 out-of-bounds write) in an affected network-facing component. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated, low-complexity network exploitation with full confidentiality, integrity, and availability impact. IBM has published a fix; no public exploit identified at time of analysis and no CISA KEV listing, so this is currently a high-severity but not confirmed-exploited issue.
OS command injection in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables an unauthenticated attacker with adjacent network access to execute arbitrary operating system commands without any user interaction. The flaw (CWE-78) resides in a network-exposed component that fails to neutralize shell metacharacters before incorporating user-supplied input into OS commands, granting full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, but a vendor patch is available via IBM support advisory.
OS command injection in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 allows an adjacent network attacker without credentials to execute arbitrary operating system commands. The flaw (CWE-78) arises from improper neutralization of special elements passed to OS command constructors, exposing the full confidentiality, integrity, and availability of affected hosts. No public exploit or CISA KEV listing has been identified at time of analysis, though a vendor patch is available via IBM Support.
Stack buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables unauthenticated remote code execution by any attacker with adjacent network access. The flaw (CWE-787, Out-of-bounds Write) corrupts stack memory during processing of a crafted network payload, allowing an attacker to overwrite return addresses and redirect execution without requiring credentials or user interaction. No public exploit has been identified at time of analysis and IBM has released a patch, but the AV:A/PR:N/AC:L vector makes this a high-priority fix for any organization running IBM Power Systems infrastructure.
Remote code execution in IBM PowerVM Hypervisor firmware versions FW950 through FW1120 allows an attacker with authenticated service-level access to the Flexible Service Processor (FSP) to execute arbitrary code in the host firmware runtime and gain full control of the managed Power system. An integer overflow (CWE-190) in the service processor mailbox interface is the root cause, with CVSS scope change (S:C) reflecting that exploitation breaks out from the FSP boundary into the broader host firmware and managed-system context. No public exploit or CISA KEV listing exists at time of analysis; however, the combination of complete C/I/A impact and scope change makes this a high-priority patch target for any organization running affected IBM Power hardware.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering an out-of-bounds write (CWE-787) in an affected component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates the flaw is reachable over the network by unauthenticated attackers with low complexity, yielding full compromise of confidentiality, integrity, and availability. IBM has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote information disclosure in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from an integer underflow in the kernel's IPv4 IP-options parser (CWE-125 out-of-bounds read), letting a remote attacker leak sensitive memory contents by sending crafted IP packets. IBM (the reporting vendor) rates it CVSS 9.4, and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
TOCTOU race condition in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 permits a local, low-privileged user to overwrite critical system files or extract sensitive information by exploiting the timing gap between a file-check and file-use operation. The attack is constrained to local access with high exploitation complexity, yet the potential impact spans full confidentiality, integrity, and availability compromise of the affected system. No public exploit or CISA KEV listing exists at time of analysis; IBM has released a vendor patch.
Remote denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows unauthenticated network attackers to crash or exhaust resources in the SSL subsystem by omitting an expected client certificate during the TLS handshake. The CVSS 7.5 rating (AV:N/AC:L/PR:N/UI:N) confirms low attack complexity with no authentication required, making exploitation straightforward against any exposed SSL service on affected systems. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the patch is available and should be prioritized for internet-facing AIX and VIOS deployments.
Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables unauthenticated remote attackers to exhaust system resources via network-delivered input, fully disabling availability (CVSS A:H) without any confidentiality or integrity impact. The vulnerability is rooted in CWE-400 uncontrolled resource consumption, triggered from the network with no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N). No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available from IBM.
Denial of service in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker crash or hang the affected system by triggering an integer underflow (CWE-190) in a network-reachable component. The flaw was reported by IBM, which has released a fix; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. Note that IBM's published CVSS 9.8 claims full confidentiality/integrity/availability impact, which conflicts with the description's DoS-only wording.
Denial of service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 allows unauthenticated remote attackers to exhaust system resources and render affected systems unavailable by sending crafted network input that triggers uncontrolled resource consumption (CWE-400). The CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms low-complexity, unauthenticated remote exploitability with a high availability impact. No active exploitation has been confirmed in CISA KEV, and no public exploit code is known at time of analysis; a vendor patch is available via IBM's support portal.
Unbounded recursion in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 exposes these systems to remote denial-of-service attacks requiring no authentication or user interaction. Network-reachable attackers can trigger uncontrolled resource consumption, exhausting stack or memory resources and disrupting availability of affected systems. No public exploit code has been identified and CISA KEV does not list this vulnerability; a vendor-released patch is available via IBM's support portal.
TNC policy server impersonation in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a network-positioned attacker forge the Trusted Network Connect policy server and tamper with the traffic between it and the endpoint, because the client fails to properly validate the server's certificate (CWE-295). An attacker who can intercept the session can present a fraudulent certificate, read limited data and alter integrity-critical policy exchanges. IBM has released a fix; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Full host-system memory access in IBM Power Systems Firmware allows a privileged BMC/FSP attacker to read and write arbitrary regions of host memory, yielding complete control over the host and all hosted logical partitions. Affected firmware spans multiple generations including FW1120.00, FW1110.x, FW1060.x, FW950.x, and OP940.x lines covering Power9 and Power HMC platforms. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, though the scope-changing impact (S:C) and full C/I/A triad make this a critical priority for any environment where BMC/FSP access is not tightly controlled.
Memory corruption and persistent denial-of-service in IBM Power Systems Firmware exposes OpenPOWER environments to host-level crashes triggered from guest partitions. An attacker holding root access within a guest partition can write a specially crafted NVRAM image that causes the host firmware boot stage to crash with possible memory corruption, taking down the managed system until an operator manually clears NVRAM via the service processor. No public exploit code has been identified and no active exploitation is confirmed, but the persistence of the availability impact and the cross-boundary scope change (guest-to-host) make this a meaningful risk in shared multi-tenant OpenPOWER environments.
IBM Power Systems Firmware across three firmware branches exposes a privilege escalation path across the BMC/FSP-to-host boundary, allowing an attacker already holding service account or root credentials on the Flexible Service Processor to read and disrupt host processor state, cascading impact to all logical partitions (LPARs) hosted on the managed system. The scope change confirmed in the CVSS vector (S:C) distinguishes this from a typical local privilege issue: exploitation crosses the management-plane isolation barrier and can affect production workloads running on every partition. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Remote code execution in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950.H2) lets an unauthenticated attacker with adjacent-network access to the ASMI web interface send a malformed request that overflows a stack buffer on the Flexible Service Processor (FSP), yielding arbitrary code execution and full control of the managed system. Because the FSP is the service processor beneath the OS, compromise crosses a scope boundary (CVSS S:C) and breaks confidentiality, integrity, and availability of the whole platform. No public exploit identified at time of analysis; IBM has released a fix and reported the issue itself.
Authentication bypass in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950.H2) lets an unauthenticated attacker positioned on the Flexible Service Processor (FSP) management network assume full administrative control of the managed system. An attacker can manipulate partition power state, alter configuration, and access partition consoles across every hosted LPAR, yielding complete confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the flaw is not on CISA KEV, but the 9.6 CVSS and scope-changing impact make it a high-priority patch for datacenters running IBM Power hardware.
Remote code execution in IBM Power Systems Firmware is possible via a stack-based buffer overflow (CWE-121) in the FSP management network protocol. An attacker holding authenticated HMC administrator credentials and adjacent-network access to the management interface can trigger the overflow to execute arbitrary code on the Flexible Service Processor, achieving full out-of-band control over all managed hardware and hosted workloads. No public exploit code and no CISA KEV listing are confirmed at time of analysis; the vendor has released a patch.
Cross-site request forgery in IBM Power Systems Firmware's ASMI web interface allows a network-based attacker to silently execute arbitrary administrative actions against the Flexible Service Processor (FSP) by tricking a logged-in ASMI administrator into visiting a crafted page. Affected versions span four major firmware branches - FW950, FW1060, FW1110, and FW1120 - covering a broad range of IBM Power hardware in production. No public exploit identified at time of analysis, though the high integrity and availability impact against firmware-level management infrastructure makes this a significant risk for affected organizations.
Unauthenticated crash and possible memory corruption in the IBM Power Systems ASMI web interface exposes multiple firmware release trains (FW950, FW1060, FW1110, FW1120) to repeated denial of out-of-band management access. An attacker present on the management network can trigger ASMI web server crashes without credentials, and sustained repeated exploitation can lock administrators out of the ASMI interface entirely - though hosted logical partitions remain unaffected. No public exploit code has been identified at time of analysis, and IBM has issued a patch via advisory 7283898.
Arbitrary code execution on IBM Power Systems host environments is achievable by an attacker with service-level access to the Baseboard Management Controller (BMC), exploiting a stack-based buffer overflow (CWE-121) in the BMC-to-host communication interface. Affected firmware versions FW1120.00 and FW1110.00 through FW1110.30 are vulnerable; successful exploitation yields full control over the host system and all hosted logical partitions (LPARs), resulting in complete confidentiality, integrity, and availability compromise across all co-located workloads. No public exploit has been identified at time of analysis, and the CVE is not currently listed in the CISA KEV catalog; IBM has released a remediation patch via advisory at https://www.ibm.com/support/pages/node/7283220.
Full takeover of IBM Power Systems host partitions and all hosted logical partitions (LPARs) is achievable by any actor holding service account or root credentials on the BMC or FSP management controller across multiple IBM Power firmware generations. The flaw (CWE-863, Incorrect Authorization) permits writing arbitrary data to hardware control registers via the BMC/FSP-to-host interface, collapsing the security boundary between the out-of-band management plane and every workload running on the system. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV; IBM has released a firmware patch via support advisory 7283218.
Arbitrary code execution on IBM Power Systems host is achievable by any attacker who already holds service account or root access to the BMC or FSP management controller. The vulnerability resides in the interface layer between the BMC/FSP and the host, where missing authorization checks (CWE-862) allow an authenticated BMC-level principal to cross the trust boundary and execute code with full host-system privileges. All hosted logical partitions are consequently exposed, making this a critical lateral-movement and privilege-escalation path within IBM Power infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in IBM Power Firmware's host firmware configuration parser allows an attacker with service-level access to the BMC/FSP to supply specially crafted configuration data, triggering CWE-121 during the firmware boot stage and compromising the entire software stack loaded thereafter. Affected firmware spans multiple major release trains - FW1120, FW1110, FW1060, FW950, and OP940 - covering Power9 and Power HMC managed systems. No public exploit has been identified at the time of analysis, and a vendor patch is available from IBM.
Arbitrary code execution in IBM Power Firmware across multiple firmware branches (FW1120.00, FW1110.x, FW1060.x, FW950.x, OP940.x) stems from a CWE-787 out-of-bounds write in the service processor mailbox interface. An authenticated attacker with service-level access to the BMC/FSP can exploit this buffer overflow to cross the trust boundary from the management processor into the host firmware runtime, gaining full control over the managed Power system. No public exploit has been identified at time of analysis; IBM has released a patch per advisory 7283236.
Arbitrary code execution on IBM Power host systems is possible when an attacker with service processor access supplies a maliciously crafted firmware update image that bypasses boot-time image validation. Affected firmware versions span three release trains: FW1120.00, FW1110.00-FW1110.30, and FW1060.00-FW1060.80. Exploitation yields full confidentiality, integrity, and availability impact on the host, with scope change indicating the compromise extends beyond the service processor itself. No public exploit or CISA KEV listing is identified at this time.
Unauthenticated remote attackers can overwrite administrator email addresses and abuse IBM Langflow OSS as an outbound mail relay by exploiting a missing authentication control on the registration endpoint, affecting versions 1.0.0 through 1.10.0. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms trivially reachable exploitation with no credentials or user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this viable for opportunistic exploitation once the endpoint is discovered.
IBM AIX 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, expose a time-of-check time-of-use (TOCTOU) race condition that local, unprivileged attackers can exploit to corrupt data integrity or crash the system. The flaw requires only local shell access with no privileges, making it exploitable by any local user account on affected POWER-architecture systems. No public exploit code or CISA KEV listing exists at time of analysis, though a vendor patch is available.
Uncontrolled resource consumption in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 exposes these systems to remote denial-of-service attacks requiring no authentication or user interaction. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms any network-reachable attacker can trigger availability loss without special privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and a vendor patch is available.
IBM AIX 7.2 and 7.3, and PowerVM VIOS 4.1 expose an unauthenticated remote denial-of-service condition rooted in a NULL pointer dereference. A remote attacker with no credentials or user interaction can crash affected network-accessible components, resulting in complete availability loss (A:H) with no confidentiality or integrity impact. No public exploit code or active exploitation has been confirmed at time of analysis, and IBM has released a patch via advisory https://www.ibm.com/support/pages/node/7283858.
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute arbitrary operating-system commands due to improper neutralization of special elements (CWE-78). Rated CVSS 9.9 with a scope change, a successful low-privilege attacker can break out of the application context and run commands on the underlying enterprise Unix host, threatening confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and network reachability make it a high-priority patch.
Heap buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables unauthenticated remote code execution by attackers positioned on an adjacent network segment, with no user interaction required. The flaw (CWE-787, out-of-bounds write) results in full compromise of confidentiality, integrity, and availability of the affected system. A vendor patch has been released via IBM advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote denial-of-service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 is caused by a CWE-787 out-of-bounds write reachable by unauthenticated network attackers with no complexity prerequisites. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects straightforward remote triggering with high availability impact but no confidentiality or integrity consequence. IBM has released a patch via the vendor advisory; no public exploit code has been identified at time of analysis.
Local privilege escalation in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows an authenticated low-privileged user to gain full elevated privileges due to improper privilege management (CWE-269). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that any standard local user account is sufficient to trigger the flaw with low complexity and no user interaction, resulting in complete confidentiality, integrity, and availability compromise of the affected system. No public exploit identified at time of analysis, and a vendor patch is available via IBM advisory.
Remote denial-of-service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables an unauthenticated network attacker to exhaust system resources and crash or severely degrade affected hosts. The root cause is uncontrolled resource consumption (CWE-400), exploitable without authentication or user interaction via a network-accessible service. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch addressed in advisory node/7283858.
Unauthenticated remote access to NFS-exported filesystems is possible in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 due to improper authentication (CWE-287). The CVSS vector AV:N/AC:L/PR:N/UI:N confirms that unauthenticated remote attackers on the network can exploit this with low complexity and no user interaction, gaining high-confidence read access and limited write access to exported filesystem data. No public exploit has been identified at time of analysis, and IBM has released a patch via advisory 7283858.
Remote denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is exploitable by unauthenticated attackers who send malformed client registration packets to the NIM (Network Installation Manager) server, triggering a classic buffer overflow that crashes the nimserver daemon. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms low-complexity, network-accessible exploitation requiring no privileges, though impact is strictly limited to availability - no confidentiality or integrity exposure is present. IBM has released a patch via support advisory 7283858; no public exploit code has been identified and this vulnerability does not appear on the CISA KEV catalog at time of analysis.
Remote privilege escalation to root in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 stems from an improper authentication weakness (CWE-287) that lets an unauthenticated network attacker bypass identity checks and obtain root-level control. The CVSS 9.8 rating reflects a network-reachable, low-complexity flaw requiring no privileges or user interaction, with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the severity and unauthenticated network vector make it a high-priority patching target for IBM Power estates.
Improper TLS certificate validation in the NIM (Network Installation Management) subsystem of IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 enables remote attackers to gain unauthorized access to AIX systems by exploiting the failure to verify certificate authenticity during NIM communications. The CVSS 8.1 High score reflects high confidentiality and integrity impact across a network-exploitable path with low complexity and no user interaction required. No public exploit identified at time of analysis, but the authentication bypass classification of this flaw makes it a meaningful privilege escalation and lateral movement risk in IBM Power environments.
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands through the Network Installation Manager (NIM) component. Because NIM typically operates with high (often root-level) privilege and the CVSS scope is Changed, successful exploitation can compromise the underlying operating system with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the 9.9 base score and low attack complexity make it a high-priority patch for IBM Power estates.
Sensitive-key exposure in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 Network Installation Management (NIM) leaks intermediate certificate authority (CA) private keys inside a publicly downloadable update file, letting remote attackers forge trusted certificates and bypass security restrictions. Rated CVSS 9.1, the flaw impacts confidentiality and integrity (C:H/I:H) but not availability, and IBM has released a fix. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the ease of obtaining a live CA key makes this a high-priority credential-hygiene issue.
Unauthenticated remote file overwrite in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is possible via the nimesis registration service, which fails to sanitize path traversal sequences in client-supplied input. An attacker with network access to the nimesis service can write arbitrary content to locations outside the intended directory, potentially overwriting sensitive system files such as cron jobs, init scripts, or authentication databases. No public exploit or active exploitation has been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is straightforwardly exploitable without authentication.
Sensitive file disclosure in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 is possible through a path traversal flaw (CWE-22) that allows attackers to escape a restricted directory boundary and read files outside the intended accessible path, resulting in high confidentiality impact. The CVE description attributes the exposure to a remote authenticated attacker, though this conflicts with the NVD-assigned CVSS vector - a discrepancy security teams must resolve before finalizing triage. A vendor patch is available via IBM Support advisory node/7283359; no public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file deletion in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 is achievable by remote authenticated attackers holding only low-privileged credentials, exploiting a path traversal flaw that bypasses directory boundary enforcement to reference and delete files anywhere on the target filesystem. The CVSS 3.1 score of 8.1 reflects high integrity and availability impact with low attack complexity, though the EPSS score of 0.44% at the 37th percentile signals limited observed exploitation probability at time of analysis. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog.
Remote CL command execution in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 lets a remote attacker run arbitrary Control Language commands on the IBM i host because special elements in a command are not properly neutralized (CWE-78). The CVSS 3.1 base score is 9.8 with a fully network-facing, no-privilege, no-interaction vector, meaning an unauthenticated remote attacker can achieve high-impact code execution. There is no public exploit identified at time of analysis and EPSS is modest at 0.47% (39th percentile), but the combination of unauthenticated network reach and full CIA impact makes this a high-priority patch.
Remote code execution in IBM Db2 Mirror for i (versions 7.4, 7.5, and 7.6) allows a remote unauthenticated attacker to run arbitrary code by exploiting external control of a file name or path (CWE-73). The flaw carries a CVSS 9.8 rating with a network attack vector and no privileges or user interaction required, and IBM has published a fix. No public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in IBM Db2 Mirror for i (versions 7.4, 7.5, and 7.6) lets a remote, unauthenticated attacker read or modify sensitive information by exploiting improper validation of request URI path segments. Because the flaw is reachable over the network without credentials or user interaction, an attacker can defeat access controls on the replication/administration interface and reach protected functionality or data. No public exploit has been identified at time of analysis, but the maximal CVSS 9.8 rating and the low attack complexity make this a high-priority patching target.
Arbitrary file write via path traversal in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 enables remote unauthenticated attackers to place files at any location on the underlying IBM i system. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/I:H) confirms network-reachable exploitation without authentication, with a scope change indicating impact beyond the Db2 Mirror application itself - reaching OS-level paths. No public exploit or KEV listing has been identified at time of analysis, and an EPSS of 0.59% (46th percentile) suggests low observed exploitation activity despite the high CVSS base score.
Uncontrolled recursion in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote unauthenticated attackers to crash the service, resulting in a complete loss of availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is exploitable over the network without credentials or user interaction, making it trivially reachable in any internet- or network-exposed deployment. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, but the low attack complexity elevates practical risk.
Arbitrary file write via path traversal in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes systems to unauthenticated remote exploitation. The flaw stems from improper pathname restriction (CWE-22), enabling an attacker to escape the intended directory sandbox and write files to arbitrary filesystem locations. No active exploitation has been confirmed in CISA KEV, and no public proof-of-concept exploit is known at the time of analysis, though the CVSS 8.2 High rating and network-accessible attack vector make this a credible priority for organizations running IBM i environments.
Path traversal in IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 enables remote authenticated attackers to read sensitive files outside intended directory boundaries due to improper input validation (CWE-22). The vulnerability results in high confidentiality impact with no integrity or availability consequence. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available via IBM support advisory node 7283359.
Security restriction bypass in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 permits remote authenticated attackers to exceed their authorized privilege level via manipulated user-supplied input processed without adequate authorization checks. With a CVSS score of 8.8 and full confidentiality, integrity, and availability impact, exploitation could allow an attacker with only low-privilege credentials to read, modify, or disrupt mirrored database content. No public exploit code and no CISA KEV listing have been identified at time of analysis, though a vendor patch is available.
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes a network-accessible pathway through which an unauthenticated remote attacker can externally influence system configuration settings (CWE-15), enabling disclosure of sensitive information and - per the CVSS vector - potential integrity and availability compromise as well. The changed scope (S:C) in the CVSS vector indicates the vulnerability can propagate impact beyond the directly affected component, consistent with how mirror configuration alterations can affect the paired IBM i high-availability node. A vendor-released patch is available via IBM Support; no public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Account takeover in IBM Langflow OSS versions 1.0.0 through 1.9.6 is possible because the platform fails to limit repeated failed authentication attempts (CWE-307), letting remote attackers brute-force or credential-stuff their way into user accounts. IBM (the reporting vendor) rates it CVSS 9.1 with high confidentiality and integrity impact, reflecting full compromise of a targeted account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the missing lockout control is trivial to abuse against weak or reused credentials.
Stack-based buffer overflow in the Native IBM i JSSE (Java Secure Socket Extension) provider enables local authenticated attackers with low privileges to execute arbitrary code or crash the JVM process on IBM i versions 7.3 through 7.6. The flaw is triggered during TLS session establishment via improper bounds checking against a fixed-length stack buffer. No public exploit or active exploitation has been identified at time of analysis - EPSS stands at 0.22% (12th percentile) and SSVC exploitation status is 'none' - but a vendor patch is available and should be applied given the high-impact code execution potential.
Privilege escalation in IBM i versions 7.3 through 7.6 allows a local authenticated attacker to abuse improper authorization controls in the Navigator for i debugger component to access or manipulate sensitive system data, or create new profiles with elevated privileges. The vulnerability is classified under CWE-285 (Improper Authorization), indicating the debugger fails to enforce sufficient privilege checks before granting access to sensitive operations. No public exploit or CISA KEV listing exists at time of analysis, though SSVC assesses the technical impact as total should exploitation occur.
Privilege escalation in IBM i (7.3, 7.4, 7.5, 7.6) lets a remote, authenticated attacker gain elevated privileges by abusing improper validation of pointers read from Java-controlled addresses, giving full compromise of the affected component and a scope-changing impact beyond it. IBM assigned a critical CVSS 9.9 (S:C) despite requiring low privileges. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none, so this is a patch-worthy critical without evidence of active abuse yet.
Security-restriction bypass in IBM i (the operating system for IBM Power servers, formerly OS/400) versions 7.3 through 7.6 lets a remote attacker abuse improper validation of user-controlled addresses to elevate privileges and cross a security boundary. Vendor scoring rates this a maximum-severity, unauthenticated network flaw (CVSS 10.0, scope-changed), though there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.33%). IBM published a fix, and CISA's SSVC framework currently marks exploitation as 'none' with a 'total' technical impact.
Thread authority swap mismanagement in IBM i 7.3 through 7.6 enables a low-privileged local attacker to gain elevated system authorities, including potentially *ALLOBJ-equivalent access. The CVSS scope change (S:C) confirms that successful exploitation extends privilege impact beyond the attacker's own user profile, threatening the broader system partition. No public exploit or active CISA KEV listing exists at time of analysis; risk is driven by low attack complexity and the critical role IBM i plays in regulated enterprise environments.
Remote denial of service via stack-based buffer overflow affects IBM i versions 7.3 through 7.6, allowing unauthenticated network attackers to crash an affected service without any user interaction or elevated privileges. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation is straightforward from the network with no special conditions, making this a reliable availability threat against exposed IBM i systems. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; however, the vendor has released a patch via the IBM support portal.