IBM
Monthly
Local arbitrary code execution in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1, stems from an out-of-bounds read (CWE-125) exploitable by a low-privileged local user with no user interaction required. A successful attacker achieves full confidentiality, integrity, and availability compromise of the affected system, as reflected in the CVSS 3.1 score of 7.8 (High) with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity makes this a credible local privilege escalation path on POWER-architecture infrastructure.
Remote code execution in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1, stems from a stack-based buffer overflow (CWE-787) that a remote attacker can trigger to run arbitrary code with no authentication or user interaction, per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) scoring 9.8 Critical. IBM PSIRT is the reporting source. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the unauthenticated network-facing nature makes it a high-priority patching target for AIX and VIOS operators.
Denial of service via uncontrolled recursion affects IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1, enabling a remote unauthenticated attacker to crash affected systems with no authentication or user interaction required. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects low attack complexity and a fully network-exploitable path, making opportunistic or targeted disruption feasible against any exposed instance. IBM has released a patch via its support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote denial-of-service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows unauthenticated network attackers to crash affected systems via a buffer overflow. The flaw is classified as CWE-787 (out-of-bounds write), enabling complete availability impact with no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a use-after-free (CWE-416) that a network-based attacker can trigger without authentication or user interaction, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). Successful exploitation yields full compromise of confidentiality, integrity, and availability (CVSS 9.8). IBM has released a fix and there is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Information disclosure and denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 arise from a kernel heap over-read that a remote attacker can trigger without authentication or user interaction. Successful exploitation leaks sensitive kernel memory contents and can crash the affected system, and the CVSS 9.1 rating reflects the combined high confidentiality and availability impact. No public exploit has been identified at time of analysis, and the EPSS probability is low (0.34%).
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a classic buffer overflow (CWE-120). The flaw carries a CVSS 9.8 with a network, no-authentication, no-interaction vector, meaning a successful exploit yields full compromise of the affected Unix host. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but a vendor patch is available.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 stems from improper certificate validation (CWE-295), allowing a remote attacker to execute arbitrary code without authentication. Because the flawed TLS/certificate trust check can be abused over the network, an attacker positioned to intercept or impersonate a trusted endpoint could deliver a malicious payload to the affected component. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.32%), but the CVSS 9.8 rating and unauthenticated network vector make this a high-priority patch on affected enterprise UNIX systems.
Out-of-bounds read in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables local low-privileged attackers to either extract sensitive memory contents or crash the system, producing a denial of service. The flaw (CWE-125) requires only a standard local user account with no additional configuration, making it relevant to any multi-tenant AIX or VIOS deployment where untrusted users share system access. No public exploit code exists and EPSS sits at 0.15% (5th percentile), and SSVC confirms no known active exploitation at time of analysis.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a heap buffer overflow (CWE-787, out-of-bounds write). The CVSS 3.1 base score is 9.8 with a network vector and no privileges or user interaction required, but there is no public exploit identified at time of analysis and EPSS estimates only a 0.32% 30-day exploitation probability. IBM has published an advisory and a patch is available from the vendor.
Out-of-bounds memory write in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker corrupt process memory to compromise system confidentiality and integrity, but not availability, per the CVSS 9.1 vector. IBM has published a fix (support advisory node/7283858), and there is no public exploit identified at time of analysis. EPSS is low at 0.43% (36th percentile) and CISA SSVC records no observed exploitation, so this is a vendor-disclosed memory-corruption issue rather than a mass-exploited one.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a network-based attacker to run arbitrary code by bypassing authentication (CWE-287). The CVSS 9.8 rating reflects unauthenticated network exploitation with total confidentiality, integrity, and availability impact, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV. IBM has released a fix, and the moderate EPSS score (0.69%, 50th percentile) suggests exploitation is plausible but not yet widespread.
Arbitrary command execution on IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 is achievable by a local attacker through improper privilege management (CWE-269), yielding full confidentiality, integrity, and availability compromise of the affected system. The vulnerability carries a CVSS 7.8 HIGH score with a local attack vector, no prior privileges required, and a user interaction dependency. No public exploit code has been identified at time of analysis; a vendor-released patch is available via IBM's support advisory.
Arbitrary code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is enabled by an integer underflow that triggers an out-of-bounds memory write, allowing a local low-privileged attacker to execute code with elevated or host-level impact. The CVSS Scope:Changed metric indicates exploitation may allow breakout beyond the initially compromised component - particularly significant in PowerVM VIOS, where a VIOS partition compromise could affect the underlying hypervisor or other hosted LPARs. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Local privilege escalation in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables any low-privileged authenticated user to achieve full system compromise through improper symbolic link handling. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms complete confidentiality, integrity, and availability impact with no user interaction required. No public exploit identified at time of analysis; a vendor patch has been released via IBM advisory https://www.ibm.com/support/pages/node/7283858.
Privilege escalation in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a local low-privileged attacker to gain elevated system access by exploiting improper symbolic link resolution (CWE-59). The CVSS 7.8 High score reflects full confidentiality, integrity, and availability impact on successful exploitation, though the local attack vector (AV:L) and low EPSS of 0.17% (7th percentile) substantially constrain real-world risk. No public exploit or active exploitation has been identified at time of analysis, and IBM has released a patch via its support portal.
Sensitive information disclosure affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 via improper authentication (CWE-287), allowing unauthenticated remote attackers to obtain confidential data over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction, making it trivially reachable from any network-adjacent position. No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE, but the automatable SSVC classification means scripted, mass-scanning attacks are plausible once a technique is known.
Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables remote unauthenticated attackers to crash affected systems by sending crafted network input, resulting in a denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates straightforward network-reachable exploitation with no privilege or user interaction required. No public exploit code has been identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog.
Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 via heap buffer overflow (CWE-787) enables an authenticated local attacker with standard user-level access to gain elevated - potentially root - privileges on affected systems. The CVSS 7.8 High score reflects full confidentiality, integrity, and availability impact despite the local attack vector, making this a serious insider-threat and post-compromise escalation risk. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 enables a local low-privileged attacker to execute arbitrary code, achieving full system compromise (C:H/I:H/A:H). The attack requires only a local account with standard user privileges and no user interaction, making post-authentication lateral movement or privilege escalation a realistic threat in IBM Power-based enterprise environments. No public exploit identified at time of analysis, but a vendor-released patch is available.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables a local low-privileged attacker to execute arbitrary code, achieving full confidentiality, integrity, and availability compromise of the affected system. The CVSS score of 7.8 reflects the high post-exploitation impact despite the local attack vector requirement. No public exploit has been identified at time of analysis, and SSVC confirms no known exploitation activity, though the vendor has released a patch.
Heap-based buffer overflow in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 enables a local, low-privileged attacker to execute arbitrary code, achieving full compromise of confidentiality, integrity, and availability. The vulnerability stems from unsafe memory writes (CWE-787) that corrupt heap structures at runtime. No public exploit code or active exploitation has been identified at time of analysis, and IBM has released a patch via the advisory at ibm.com/support/pages/node/7283858.
Local privilege escalation in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows a low-privileged local user to gain elevated-likely root-level-access through improper privilege management (CWE-269). The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N) reflects low-complexity exploitation requiring only a standard local account with no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though IBM has released a patch via their support portal.
Local code execution via buffer overflow affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1, allowing a low-privileged local attacker to execute arbitrary code with a scope change that can compromise components beyond the initially vulnerable boundary. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C) indicates exploitation requires only a local shell with standard user privileges and no interaction, yet the scope change elevates the impact to full CIA triad compromise. No public exploit identified at time of analysis, and a vendor-released patch is available from IBM.
Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 allows a low-privileged local attacker to gain elevated - potentially root-level - privileges by winning a time-of-check to time-of-use (TOCTOU) race condition. The vulnerability carries a CVSS 7.0 score reflecting high attack complexity due to the inherent timing constraints of race condition exploitation, though successful exploitation yields total CIA impact (full system compromise). No public exploit code has been identified and CISA SSVC classifies exploitation status as none, consistent with the extremely low EPSS score of 0.12%.
Privilege escalation via heap-based buffer overflow affects IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1, enabling a local attacker with standard user-level access to gain elevated - potentially root-level - privileges on the affected system. The CVSS scope-changed (S:C) rating confirms that successful exploitation extends control beyond the attacker's initial security context, threatening the entire host including virtual machine management infrastructure on PowerVM. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory node 7283858.
Arbitrary OS command execution via ODMDIR environment variable manipulation affects IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1, enabling local authenticated users to escalate privileges beyond their initial access boundary. The CVSS scope change (S:C) indicates that successful exploitation can compromise components outside the immediate process context - a critical concern for AIX systems hosting sensitive workloads. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but a vendor patch is available through IBM's support portal.
Denial of service via heap-based buffer overflow affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1, exploitable by remote unauthenticated attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making this a low-friction remote availability attack against IBM Power Systems infrastructure. No active exploitation or public exploit code has been identified at time of analysis; a vendor patch is available via IBM's support portal.
Local privilege escalation in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables a low-privileged local attacker to gain root access by winning a time-of-check to time-of-use (TOCTOU) race condition. The attack requires local access and precise timing, reflected in the AC:H CVSS metric, which meaningfully constrains practical exploitability. No public exploit or active exploitation is identified; EPSS sits at 0.12% (2nd percentile), consistent with the SSVC 'Exploitation: none' classification, though SSVC also rates technical impact as total given that successful exploitation yields full root control.
Arbitrary file overwrite in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker corrupt or replace files on the host due to improper neutralization of special elements in input (CWE-73). The CVSS 3.1 base score is 9.1 (I:H/A:H, no confidentiality impact), reflecting integrity and availability damage without data disclosure. No public exploit identified at time of analysis, but IBM has published a fix, and the network/low-complexity/no-privileges vector makes this a high-priority patch for exposed AIX and VIOS management interfaces.
Privilege escalation on IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows any low-privileged local user to gain full system control by exploiting improper authorization checks (CWE-285). SSVC rates the technical impact as total, consistent with the CVSS C:H/I:H/A:H rating, meaning a successful attacker achieves complete compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and EPSS at 0.13% (3rd percentile) reflects negligible current exploitation pressure, though the low attack complexity makes this a meaningful insider-threat or post-compromise escalation risk.
Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is achievable by unauthenticated remote attackers who send crafted IPsec packets that trigger an integer underflow (CWE-191) during decapsulation, causing an improper memory offset calculation that crashes the affected system. The CVSS vector confirms network-accessible, zero-authentication exploitation with low complexity, yielding a full availability impact with no confidentiality or integrity exposure. IBM has released a patch; no public exploit code or CISA KEV listing exists at time of analysis.
Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 allows an authenticated local attacker with low-level access to gain elevated (likely root) privileges due to improper privilege management (CWE-269). The CVSS score of 7.8 reflects total confidentiality, integrity, and availability impact upon successful exploitation. No public exploit has been identified at time of analysis, EPSS is extremely low at 0.11% (2nd percentile), and SSVC confirms no observed exploitation, though technical impact is rated total if the flaw is triggered.
Local arbitrary code execution is possible in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 through a TOCTOU race condition (CWE-367), where a low-privileged local attacker can manipulate a resource between its check and its use by a privileged process. The CVSS 7.0 score reflects high confidentiality, integrity, and availability impact, though the high attack complexity (AC:H) indicates the timing window must be won reliably. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; IBM has released a patch via its support advisory.
Remote authenticated exploitation of IBM i versions 7.3 through 7.6 via an out-of-bounds read (CWE-125) enables attackers to both crash the system and exfiltrate sensitive data from adjacent memory regions. The CVSS 8.1 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) reflects significant dual confidentiality and availability impact achievable over the network without user interaction, though a minimum of low-privilege credentials is required, limiting the attack surface to authenticated accounts. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at a low 0.31% (24th percentile), and SSVC rates the attack as non-automatable.
Image policy bypass in IBM Portieris 0.5.0 through 0.14.2 allows remote authenticated attackers to circumvent container image verification controls by exploiting improper authorization of pod owner references (CWE-862). An attacker with low-privilege Kubernetes cluster access can deploy containers from untrusted or unverified images, effectively nullifying the admission controller's entire security enforcement purpose. No public exploit has been identified at time of analysis, but a vendor patch is available via IBM's security advisory.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets an unauthenticated network attacker run arbitrary code by supplying malicious pointers that the OS fails to validate (CWE-843 type confusion). The flaw carries a critical CVSS 9.8 and was disclosed by IBM PSIRT with no user interaction required, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because AIX/VIOS underpins production IBM Power server estates, a working exploit would give attackers full compromise of the affected operating system.
Remote code execution in IBM AIX 7.2 and 7.3, and in the IBM PowerVM VIOS 4.1 virtualization stack, stems from an integer overflow (CWE-190) that a network-based attacker can trigger without authentication or user interaction. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects unauthenticated remote exploitation with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; no EPSS score was supplied in the input.
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 stems from a stack-based buffer overflow that a remote attacker can trigger without authentication, per IBM PSIRT (CVE-2026-16913). With a CVSS 3.1 base of 9.8 (AV:N/AC:L/PR:N/UI:N) and full CIA impact, successful exploitation yields arbitrary code execution on the affected UNIX operating system or virtualization I/O server. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the network-reachable, unauthenticated profile makes this a high-priority patch.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows remote authenticated attackers to execute arbitrary code on affected systems. The flaw (CWE-121) is reachable over the network with low attack complexity and requires only low-privilege credentials, yielding complete confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the 8.8 CVSS score and confirmed RCE potential make patching urgent for organizations running IBM POWER infrastructure.
Remote code execution in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 is enabled by an off-by-one wrap-around error in bounds checking, reachable from an adjacent network without authentication. An attacker positioned on the same network segment can trigger the flaw to achieve full compromise of the affected system - confidentiality, integrity, and availability are all rated High. No public exploit or CISA KEV listing has been identified at time of analysis, but the combination of no-auth adjacency and RCE impact makes this a high-priority patch target in any environment running these IBM platforms.
Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 lets an unauthenticated adjacent-network attacker corrupt memory to achieve arbitrary code execution or crash the affected service (denial of service). The CVSS 3.1 base score is 9.6 (Critical) with a changed scope, reflecting potential impact beyond the vulnerable component on IBM Power hardware. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
Out-of-bounds write in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables an unauthenticated attacker positioned on an adjacent network segment to execute arbitrary code with full confidentiality, integrity, and availability impact. The CWE-787 class flaw requires no privileges and no user interaction, lowering the exploitation bar substantially once network adjacency is achieved. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of zero-prerequisite exploitation and complete system compromise warrants urgent patching in affected enterprise environments.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a stack-based buffer overflow that a network-based attacker can trigger without authentication or user interaction, per the CVSS 9.8 vector. Successful exploitation yields full compromise (high confidentiality, integrity, and availability impact) of Unix systems that frequently underpin enterprise and mission-critical workloads. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.
IBM PowerVM Hypervisor across four active firmware release trains is vulnerable to arbitrary Hostboot memory read and write via the FSP service processor mailbox interface, enabling compromise of the entire host firmware boot stack and the hypervisor subsequently loaded from it. An authenticated attacker holding FSP service-level credentials can send a specially crafted mailbox message that triggers an out-of-bounds memory operation (CWE-125), achieving full confidentiality, integrity, and availability impact against the managed POWER-series system. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the scope change to the hypervisor layer makes this a critical risk for IBM POWER environments with shared or exposed FSP credentials.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an unauthenticated remote attacker to run arbitrary code by triggering a stack-based buffer overflow, per the vendor-assigned CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N. IBM (the reporting party) has published a fix, and no public exploit identified at time of analysis. EPSS and KEV signals were not provided, so the 9.8 CVSS score is currently the strongest available severity indicator.
IBM PowerVM Hypervisor across four firmware trains (FW950 through FW1120) exposes an integer overflow (CWE-190) in its hypervisor call interface that permits a guest partition root user to inject arbitrary quantities of data into hypervisor or co-resident partition memory. The scope change (S:C in CVSS) reflects that exploitation crosses the guest-hypervisor isolation boundary, enabling either a full platform re-IPL that terminates every co-hosted partition or silent corruption of hypervisor and partition memory. No public exploit has been identified at time of analysis, and IBM has released patches covering all affected firmware trains.
Remote OS command injection in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a network attacker to execute arbitrary operating-system commands due to improper neutralization of special elements (CWE-78). The CVSS 3.1 base score is 9.8 with a network, no-privilege, no-interaction vector, and IBM has published a fix. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the combination of unauthenticated remote code execution on enterprise UNIX and virtualization infrastructure makes this a high-priority patch.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables remote authenticated attackers to execute arbitrary code, achieving full compromise of confidentiality, integrity, and availability. The CVSS 8.8 score reflects low-complexity network exploitation requiring only low-privilege authentication (PR:L), making it accessible to any credentialed user on the system. No public exploit identified at time of analysis, but a vendor-released patch is available from IBM.
Shell metacharacter injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a local low-privileged attacker to execute arbitrary OS commands, resulting in complete confidentiality, integrity, and availability compromise per CVSS C:H/I:H/A:H. The root cause (CWE-78) is insufficient sanitization of special shell characters passed to an OS interpreter within an IBM-provided utility or script. IBM has released a patch; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Local privilege escalation in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables a low-privileged authenticated user to gain root access by bypassing RBAC role enforcement. The flaw (CWE-269: Improper Privilege Management) means the operating system fails to correctly enforce the boundaries between assigned RBAC roles, allowing a standard user to assume or exercise privileges reserved for root. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from an out-of-bounds write (CWE-787) that allows a low-privileged local attacker to achieve complete system compromise across confidentiality, integrity, and availability. The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) reflects low-complexity exploitation requiring only a standard local account - a realistic threshold for insider threats or post-exploitation lateral movement within IBM Power environments. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; however, the total C/I/A:H impact on high-value enterprise Unix systems warrants prompt patching.
Remote code execution in IBM PowerVM Hypervisor partition firmware exposes Power Systems environments during network boot operations. An unauthenticated attacker positioned on the same adjacent network as a partition actively performing a network boot can send a malformed packet that triggers a CWE-787 out-of-bounds write, executing arbitrary code within the partition firmware and compromising everything the partition subsequently loads. Impact is scoped to the actively booting partition - other partitions and the managed system are explicitly unaffected. No public exploit or CISA KEV listing exists at time of analysis; EPSS is notably low at 0.19% (9th percentile), consistent with the narrow exploitation window.
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 stems from a stack-based buffer overflow (CWE-121) that a network attacker can trigger without authentication or user interaction. Because the flaw carries a CVSS 9.8 with an AV:N/AC:L/PR:N/UI:N vector, a successful attack yields full compromise of confidentiality, integrity, and availability on affected enterprise UNIX hosts and virtualization I/O servers. There is no public exploit identified at time of analysis, and IBM (the reporter) has released a fix.
Local arbitrary code execution in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 stems from improperly scrubbed environment variables (CWE-426: Untrusted Search Path), allowing a low-privileged local user to inject malicious values such as PATH or LD_PRELOAD that are subsequently consumed by a privileged process. With a CVSS score of 7.8 (HIGH) and full confidentiality, integrity, and availability impact, successful exploitation yields arbitrary code execution at an elevated privilege level. No public exploit or CISA KEV listing has been identified at time of analysis, though a vendor patch is available via IBM support.
Command injection in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables an unauthenticated attacker with adjacent network access to execute arbitrary OS commands, achieving full compromise of confidentiality, integrity, and availability. The adjacent-network attack vector (AV:A) limits exposure to attackers already positioned on the same local network or VLAN as the affected system, which is a meaningful constraint in typical enterprise deployments of these platforms. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis; IBM has released a patch via its support portal.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker overflow a stack buffer (CWE-787 out-of-bounds write) and run arbitrary code on the affected Power-based host. The flaw was reported by IBM, carries a critical 9.8 CVSS rating with a network, no-privilege, no-interaction vector, and a vendor patch is available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a stack buffer overflow (CWE-787) that a network-based attacker can trigger without authentication or user interaction, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). IBM has published a fix, and no public exploit has been identified at time of analysis, though the 9.8 base score reflects full compromise of confidentiality, integrity, and availability. The exact vulnerable service/daemon is not disclosed in the available data, which limits precise attack-surface scoping.
Remote unauthenticated manipulation of network traffic and DNS configuration is possible in IBM AIX 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1, due to improper authentication controls (CWE-287). The CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no user interaction, and no special network positioning - making this accessible to any remote attacker with TCP connectivity to an affected system. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed, but the low attack complexity and high integrity impact make this a meaningful priority for IBM Power Systems environments.
Remote denial of service in IBM AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1 allows an unauthenticated network attacker to crash affected systems by triggering an integer overflow in a network-reachable component. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector confirms full availability loss with no authentication or user interaction required. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog; however, the low attack complexity means opportunistic exploitation is feasible once technical details become public.
Denial of service via use-after-free in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an unauthenticated attacker on an adjacent network to crash affected systems by triggering a memory corruption condition. The scope change (S:C) in the CVSS vector is significant in virtualization contexts: a successful attack against PowerVM VIOS could cascade to hosted virtual machines, amplifying the availability impact beyond the directly targeted component. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is achievable by an unauthenticated attacker on the same network segment via command injection triggered by crafted IPv6 Router Advertisement messages. The vulnerability (CWE-269, Improper Privilege Management) implies the RA processing subsystem executes injected commands with elevated OS-level privileges, enabling full confidentiality, integrity, and availability compromise of the affected host. No public exploit has been identified at time of analysis; IBM has released a patch per advisory https://www.ibm.com/support/pages/node/7283858.
Stack-based buffer overflow in IBM PowerVM Hypervisor's host firmware configuration parsing allows authenticated service-level access holders to crash the firmware boot stack with possible memory corruption during system initialization, impacting integrity and availability of the managed Power system. Affected firmware spans three release trains: FW1060.00-FW1060.80, FW1110.00-FW1110.30, and FW1120.00. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; IBM has released a patch via advisory at https://www.ibm.com/support/pages/node/7283238.
Arbitrary command execution against IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 is possible by an unauthenticated attacker on the same network segment who can deliver DHCP option values containing unescaped shell metacharacters to the system's DHCP client. The DHCP client fails to neutralize these metacharacters before passing option data to shell processing (CWE-78), enabling full confidentiality, integrity, and availability compromise of the target host. A vendor patch is available via IBM support, and no public exploit or CISA KEV listing has been identified at time of analysis.
Network boot exploitation in IBM PowerVM Hypervisor across firmware branches FW950, FW1060, FW1110, and FW1120 allows an unauthenticated attacker with adjacent-network access to disrupt or hijack the boot sequence of any partition performing a PXE/network boot. Under the default configuration where OS secure boot is disabled, the attacker can substitute the boot image entirely, compromising the OS and all subsequently loaded software for that partition. No active exploitation has been confirmed per SSVC and EPSS signals, but the default-configuration exposure and full partition compromise potential make this a meaningful priority for IBM Power Systems operators.
Heap buffer overflow in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 enables unauthenticated adjacent-network attackers to execute arbitrary code on affected systems. The CWE-787 out-of-bounds write flaw carries a CVSS score of 8.8 and yields full confidentiality, integrity, and availability compromise upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis; however, a vendor-supplied patch is available via IBM support advisory node/7283858.
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a heap buffer overflow (CWE-787 out-of-bounds write) in an affected network-facing component. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated, low-complexity network exploitation with full confidentiality, integrity, and availability impact. IBM has published a fix; no public exploit identified at time of analysis and no CISA KEV listing, so this is currently a high-severity but not confirmed-exploited issue.
OS command injection in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables an unauthenticated attacker with adjacent network access to execute arbitrary operating system commands without any user interaction. The flaw (CWE-78) resides in a network-exposed component that fails to neutralize shell metacharacters before incorporating user-supplied input into OS commands, granting full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, but a vendor patch is available via IBM support advisory.
OS command injection in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 allows an adjacent network attacker without credentials to execute arbitrary operating system commands. The flaw (CWE-78) arises from improper neutralization of special elements passed to OS command constructors, exposing the full confidentiality, integrity, and availability of affected hosts. No public exploit or CISA KEV listing has been identified at time of analysis, though a vendor patch is available via IBM Support.
Stack buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables unauthenticated remote code execution by any attacker with adjacent network access. The flaw (CWE-787, Out-of-bounds Write) corrupts stack memory during processing of a crafted network payload, allowing an attacker to overwrite return addresses and redirect execution without requiring credentials or user interaction. No public exploit has been identified at time of analysis and IBM has released a patch, but the AV:A/PR:N/AC:L vector makes this a high-priority fix for any organization running IBM Power Systems infrastructure.
Remote code execution in IBM PowerVM Hypervisor firmware versions FW950 through FW1120 allows an attacker with authenticated service-level access to the Flexible Service Processor (FSP) to execute arbitrary code in the host firmware runtime and gain full control of the managed Power system. An integer overflow (CWE-190) in the service processor mailbox interface is the root cause, with CVSS scope change (S:C) reflecting that exploitation breaks out from the FSP boundary into the broader host firmware and managed-system context. No public exploit or CISA KEV listing exists at time of analysis; however, the combination of complete C/I/A impact and scope change makes this a high-priority patch target for any organization running affected IBM Power hardware.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering an out-of-bounds write (CWE-787) in an affected component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates the flaw is reachable over the network by unauthenticated attackers with low complexity, yielding full compromise of confidentiality, integrity, and availability. IBM has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote information disclosure in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from an integer underflow in the kernel's IPv4 IP-options parser (CWE-125 out-of-bounds read), letting a remote attacker leak sensitive memory contents by sending crafted IP packets. IBM (the reporting vendor) rates it CVSS 9.4, and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
TOCTOU race condition in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 permits a local, low-privileged user to overwrite critical system files or extract sensitive information by exploiting the timing gap between a file-check and file-use operation. The attack is constrained to local access with high exploitation complexity, yet the potential impact spans full confidentiality, integrity, and availability compromise of the affected system. No public exploit or CISA KEV listing exists at time of analysis; IBM has released a vendor patch.
Remote denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows unauthenticated network attackers to crash or exhaust resources in the SSL subsystem by omitting an expected client certificate during the TLS handshake. The CVSS 7.5 rating (AV:N/AC:L/PR:N/UI:N) confirms low attack complexity with no authentication required, making exploitation straightforward against any exposed SSL service on affected systems. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the patch is available and should be prioritized for internet-facing AIX and VIOS deployments.
Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables unauthenticated remote attackers to exhaust system resources via network-delivered input, fully disabling availability (CVSS A:H) without any confidentiality or integrity impact. The vulnerability is rooted in CWE-400 uncontrolled resource consumption, triggered from the network with no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N). No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available from IBM.
Denial of service in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker crash or hang the affected system by triggering an integer underflow (CWE-190) in a network-reachable component. The flaw was reported by IBM, which has released a fix; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. Note that IBM's published CVSS 9.8 claims full confidentiality/integrity/availability impact, which conflicts with the description's DoS-only wording.
Denial of service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 allows unauthenticated remote attackers to exhaust system resources and render affected systems unavailable by sending crafted network input that triggers uncontrolled resource consumption (CWE-400). The CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms low-complexity, unauthenticated remote exploitability with a high availability impact. No active exploitation has been confirmed in CISA KEV, and no public exploit code is known at time of analysis; a vendor patch is available via IBM's support portal.
Unbounded recursion in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 exposes these systems to remote denial-of-service attacks requiring no authentication or user interaction. Network-reachable attackers can trigger uncontrolled resource consumption, exhausting stack or memory resources and disrupting availability of affected systems. No public exploit code has been identified and CISA KEV does not list this vulnerability; a vendor-released patch is available via IBM's support portal.
TNC policy server impersonation in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a network-positioned attacker forge the Trusted Network Connect policy server and tamper with the traffic between it and the endpoint, because the client fails to properly validate the server's certificate (CWE-295). An attacker who can intercept the session can present a fraudulent certificate, read limited data and alter integrity-critical policy exchanges. IBM has released a fix; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Full host-system memory access in IBM Power Systems Firmware allows a privileged BMC/FSP attacker to read and write arbitrary regions of host memory, yielding complete control over the host and all hosted logical partitions. Affected firmware spans multiple generations including FW1120.00, FW1110.x, FW1060.x, FW950.x, and OP940.x lines covering Power9 and Power HMC platforms. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, though the scope-changing impact (S:C) and full C/I/A triad make this a critical priority for any environment where BMC/FSP access is not tightly controlled.
Memory corruption and persistent denial-of-service in IBM Power Systems Firmware exposes OpenPOWER environments to host-level crashes triggered from guest partitions. An attacker holding root access within a guest partition can write a specially crafted NVRAM image that causes the host firmware boot stage to crash with possible memory corruption, taking down the managed system until an operator manually clears NVRAM via the service processor. No public exploit code has been identified and no active exploitation is confirmed, but the persistence of the availability impact and the cross-boundary scope change (guest-to-host) make this a meaningful risk in shared multi-tenant OpenPOWER environments.
IBM Power Systems Firmware across three firmware branches exposes a privilege escalation path across the BMC/FSP-to-host boundary, allowing an attacker already holding service account or root credentials on the Flexible Service Processor to read and disrupt host processor state, cascading impact to all logical partitions (LPARs) hosted on the managed system. The scope change confirmed in the CVSS vector (S:C) distinguishes this from a typical local privilege issue: exploitation crosses the management-plane isolation barrier and can affect production workloads running on every partition. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Remote code execution in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950.H2) lets an unauthenticated attacker with adjacent-network access to the ASMI web interface send a malformed request that overflows a stack buffer on the Flexible Service Processor (FSP), yielding arbitrary code execution and full control of the managed system. Because the FSP is the service processor beneath the OS, compromise crosses a scope boundary (CVSS S:C) and breaks confidentiality, integrity, and availability of the whole platform. No public exploit identified at time of analysis; IBM has released a fix and reported the issue itself.
Authentication bypass in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950.H2) lets an unauthenticated attacker positioned on the Flexible Service Processor (FSP) management network assume full administrative control of the managed system. An attacker can manipulate partition power state, alter configuration, and access partition consoles across every hosted LPAR, yielding complete confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the flaw is not on CISA KEV, but the 9.6 CVSS and scope-changing impact make it a high-priority patch for datacenters running IBM Power hardware.
Remote code execution in IBM Power Systems Firmware is possible via a stack-based buffer overflow (CWE-121) in the FSP management network protocol. An attacker holding authenticated HMC administrator credentials and adjacent-network access to the management interface can trigger the overflow to execute arbitrary code on the Flexible Service Processor, achieving full out-of-band control over all managed hardware and hosted workloads. No public exploit code and no CISA KEV listing are confirmed at time of analysis; the vendor has released a patch.
Cross-site request forgery in IBM Power Systems Firmware's ASMI web interface allows a network-based attacker to silently execute arbitrary administrative actions against the Flexible Service Processor (FSP) by tricking a logged-in ASMI administrator into visiting a crafted page. Affected versions span four major firmware branches - FW950, FW1060, FW1110, and FW1120 - covering a broad range of IBM Power hardware in production. No public exploit identified at time of analysis, though the high integrity and availability impact against firmware-level management infrastructure makes this a significant risk for affected organizations.
Unauthenticated crash and possible memory corruption in the IBM Power Systems ASMI web interface exposes multiple firmware release trains (FW950, FW1060, FW1110, FW1120) to repeated denial of out-of-band management access. An attacker present on the management network can trigger ASMI web server crashes without credentials, and sustained repeated exploitation can lock administrators out of the ASMI interface entirely - though hosted logical partitions remain unaffected. No public exploit code has been identified at time of analysis, and IBM has issued a patch via advisory 7283898.
Arbitrary code execution on IBM Power Systems host environments is achievable by an attacker with service-level access to the Baseboard Management Controller (BMC), exploiting a stack-based buffer overflow (CWE-121) in the BMC-to-host communication interface. Affected firmware versions FW1120.00 and FW1110.00 through FW1110.30 are vulnerable; successful exploitation yields full control over the host system and all hosted logical partitions (LPARs), resulting in complete confidentiality, integrity, and availability compromise across all co-located workloads. No public exploit has been identified at time of analysis, and the CVE is not currently listed in the CISA KEV catalog; IBM has released a remediation patch via advisory at https://www.ibm.com/support/pages/node/7283220.
Full takeover of IBM Power Systems host partitions and all hosted logical partitions (LPARs) is achievable by any actor holding service account or root credentials on the BMC or FSP management controller across multiple IBM Power firmware generations. The flaw (CWE-863, Incorrect Authorization) permits writing arbitrary data to hardware control registers via the BMC/FSP-to-host interface, collapsing the security boundary between the out-of-band management plane and every workload running on the system. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV; IBM has released a firmware patch via support advisory 7283218.
Local arbitrary code execution in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1, stems from an out-of-bounds read (CWE-125) exploitable by a low-privileged local user with no user interaction required. A successful attacker achieves full confidentiality, integrity, and availability compromise of the affected system, as reflected in the CVSS 3.1 score of 7.8 (High) with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity makes this a credible local privilege escalation path on POWER-architecture infrastructure.
Remote code execution in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1, stems from a stack-based buffer overflow (CWE-787) that a remote attacker can trigger to run arbitrary code with no authentication or user interaction, per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) scoring 9.8 Critical. IBM PSIRT is the reporting source. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the unauthenticated network-facing nature makes it a high-priority patching target for AIX and VIOS operators.
Denial of service via uncontrolled recursion affects IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1, enabling a remote unauthenticated attacker to crash affected systems with no authentication or user interaction required. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects low attack complexity and a fully network-exploitable path, making opportunistic or targeted disruption feasible against any exposed instance. IBM has released a patch via its support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote denial-of-service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows unauthenticated network attackers to crash affected systems via a buffer overflow. The flaw is classified as CWE-787 (out-of-bounds write), enabling complete availability impact with no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a use-after-free (CWE-416) that a network-based attacker can trigger without authentication or user interaction, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). Successful exploitation yields full compromise of confidentiality, integrity, and availability (CVSS 9.8). IBM has released a fix and there is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Information disclosure and denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 arise from a kernel heap over-read that a remote attacker can trigger without authentication or user interaction. Successful exploitation leaks sensitive kernel memory contents and can crash the affected system, and the CVSS 9.1 rating reflects the combined high confidentiality and availability impact. No public exploit has been identified at time of analysis, and the EPSS probability is low (0.34%).
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a classic buffer overflow (CWE-120). The flaw carries a CVSS 9.8 with a network, no-authentication, no-interaction vector, meaning a successful exploit yields full compromise of the affected Unix host. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but a vendor patch is available.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 stems from improper certificate validation (CWE-295), allowing a remote attacker to execute arbitrary code without authentication. Because the flawed TLS/certificate trust check can be abused over the network, an attacker positioned to intercept or impersonate a trusted endpoint could deliver a malicious payload to the affected component. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.32%), but the CVSS 9.8 rating and unauthenticated network vector make this a high-priority patch on affected enterprise UNIX systems.
Out-of-bounds read in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables local low-privileged attackers to either extract sensitive memory contents or crash the system, producing a denial of service. The flaw (CWE-125) requires only a standard local user account with no additional configuration, making it relevant to any multi-tenant AIX or VIOS deployment where untrusted users share system access. No public exploit code exists and EPSS sits at 0.15% (5th percentile), and SSVC confirms no known active exploitation at time of analysis.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a heap buffer overflow (CWE-787, out-of-bounds write). The CVSS 3.1 base score is 9.8 with a network vector and no privileges or user interaction required, but there is no public exploit identified at time of analysis and EPSS estimates only a 0.32% 30-day exploitation probability. IBM has published an advisory and a patch is available from the vendor.
Out-of-bounds memory write in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker corrupt process memory to compromise system confidentiality and integrity, but not availability, per the CVSS 9.1 vector. IBM has published a fix (support advisory node/7283858), and there is no public exploit identified at time of analysis. EPSS is low at 0.43% (36th percentile) and CISA SSVC records no observed exploitation, so this is a vendor-disclosed memory-corruption issue rather than a mass-exploited one.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a network-based attacker to run arbitrary code by bypassing authentication (CWE-287). The CVSS 9.8 rating reflects unauthenticated network exploitation with total confidentiality, integrity, and availability impact, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV. IBM has released a fix, and the moderate EPSS score (0.69%, 50th percentile) suggests exploitation is plausible but not yet widespread.
Arbitrary command execution on IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 is achievable by a local attacker through improper privilege management (CWE-269), yielding full confidentiality, integrity, and availability compromise of the affected system. The vulnerability carries a CVSS 7.8 HIGH score with a local attack vector, no prior privileges required, and a user interaction dependency. No public exploit code has been identified at time of analysis; a vendor-released patch is available via IBM's support advisory.
Arbitrary code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is enabled by an integer underflow that triggers an out-of-bounds memory write, allowing a local low-privileged attacker to execute code with elevated or host-level impact. The CVSS Scope:Changed metric indicates exploitation may allow breakout beyond the initially compromised component - particularly significant in PowerVM VIOS, where a VIOS partition compromise could affect the underlying hypervisor or other hosted LPARs. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Local privilege escalation in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables any low-privileged authenticated user to achieve full system compromise through improper symbolic link handling. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms complete confidentiality, integrity, and availability impact with no user interaction required. No public exploit identified at time of analysis; a vendor patch has been released via IBM advisory https://www.ibm.com/support/pages/node/7283858.
Privilege escalation in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a local low-privileged attacker to gain elevated system access by exploiting improper symbolic link resolution (CWE-59). The CVSS 7.8 High score reflects full confidentiality, integrity, and availability impact on successful exploitation, though the local attack vector (AV:L) and low EPSS of 0.17% (7th percentile) substantially constrain real-world risk. No public exploit or active exploitation has been identified at time of analysis, and IBM has released a patch via its support portal.
Sensitive information disclosure affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 via improper authentication (CWE-287), allowing unauthenticated remote attackers to obtain confidential data over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction, making it trivially reachable from any network-adjacent position. No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE, but the automatable SSVC classification means scripted, mass-scanning attacks are plausible once a technique is known.
Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables remote unauthenticated attackers to crash affected systems by sending crafted network input, resulting in a denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates straightforward network-reachable exploitation with no privilege or user interaction required. No public exploit code has been identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog.
Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 via heap buffer overflow (CWE-787) enables an authenticated local attacker with standard user-level access to gain elevated - potentially root - privileges on affected systems. The CVSS 7.8 High score reflects full confidentiality, integrity, and availability impact despite the local attack vector, making this a serious insider-threat and post-compromise escalation risk. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 enables a local low-privileged attacker to execute arbitrary code, achieving full system compromise (C:H/I:H/A:H). The attack requires only a local account with standard user privileges and no user interaction, making post-authentication lateral movement or privilege escalation a realistic threat in IBM Power-based enterprise environments. No public exploit identified at time of analysis, but a vendor-released patch is available.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables a local low-privileged attacker to execute arbitrary code, achieving full confidentiality, integrity, and availability compromise of the affected system. The CVSS score of 7.8 reflects the high post-exploitation impact despite the local attack vector requirement. No public exploit has been identified at time of analysis, and SSVC confirms no known exploitation activity, though the vendor has released a patch.
Heap-based buffer overflow in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 enables a local, low-privileged attacker to execute arbitrary code, achieving full compromise of confidentiality, integrity, and availability. The vulnerability stems from unsafe memory writes (CWE-787) that corrupt heap structures at runtime. No public exploit code or active exploitation has been identified at time of analysis, and IBM has released a patch via the advisory at ibm.com/support/pages/node/7283858.
Local privilege escalation in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows a low-privileged local user to gain elevated-likely root-level-access through improper privilege management (CWE-269). The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N) reflects low-complexity exploitation requiring only a standard local account with no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though IBM has released a patch via their support portal.
Local code execution via buffer overflow affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1, allowing a low-privileged local attacker to execute arbitrary code with a scope change that can compromise components beyond the initially vulnerable boundary. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C) indicates exploitation requires only a local shell with standard user privileges and no interaction, yet the scope change elevates the impact to full CIA triad compromise. No public exploit identified at time of analysis, and a vendor-released patch is available from IBM.
Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 allows a low-privileged local attacker to gain elevated - potentially root-level - privileges by winning a time-of-check to time-of-use (TOCTOU) race condition. The vulnerability carries a CVSS 7.0 score reflecting high attack complexity due to the inherent timing constraints of race condition exploitation, though successful exploitation yields total CIA impact (full system compromise). No public exploit code has been identified and CISA SSVC classifies exploitation status as none, consistent with the extremely low EPSS score of 0.12%.
Privilege escalation via heap-based buffer overflow affects IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1, enabling a local attacker with standard user-level access to gain elevated - potentially root-level - privileges on the affected system. The CVSS scope-changed (S:C) rating confirms that successful exploitation extends control beyond the attacker's initial security context, threatening the entire host including virtual machine management infrastructure on PowerVM. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory node 7283858.
Arbitrary OS command execution via ODMDIR environment variable manipulation affects IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1, enabling local authenticated users to escalate privileges beyond their initial access boundary. The CVSS scope change (S:C) indicates that successful exploitation can compromise components outside the immediate process context - a critical concern for AIX systems hosting sensitive workloads. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but a vendor patch is available through IBM's support portal.
Denial of service via heap-based buffer overflow affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1, exploitable by remote unauthenticated attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, making this a low-friction remote availability attack against IBM Power Systems infrastructure. No active exploitation or public exploit code has been identified at time of analysis; a vendor patch is available via IBM's support portal.
Local privilege escalation in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables a low-privileged local attacker to gain root access by winning a time-of-check to time-of-use (TOCTOU) race condition. The attack requires local access and precise timing, reflected in the AC:H CVSS metric, which meaningfully constrains practical exploitability. No public exploit or active exploitation is identified; EPSS sits at 0.12% (2nd percentile), consistent with the SSVC 'Exploitation: none' classification, though SSVC also rates technical impact as total given that successful exploitation yields full root control.
Arbitrary file overwrite in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker corrupt or replace files on the host due to improper neutralization of special elements in input (CWE-73). The CVSS 3.1 base score is 9.1 (I:H/A:H, no confidentiality impact), reflecting integrity and availability damage without data disclosure. No public exploit identified at time of analysis, but IBM has published a fix, and the network/low-complexity/no-privileges vector makes this a high-priority patch for exposed AIX and VIOS management interfaces.
Privilege escalation on IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows any low-privileged local user to gain full system control by exploiting improper authorization checks (CWE-285). SSVC rates the technical impact as total, consistent with the CVSS C:H/I:H/A:H rating, meaning a successful attacker achieves complete compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and EPSS at 0.13% (3rd percentile) reflects negligible current exploitation pressure, though the low attack complexity makes this a meaningful insider-threat or post-compromise escalation risk.
Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is achievable by unauthenticated remote attackers who send crafted IPsec packets that trigger an integer underflow (CWE-191) during decapsulation, causing an improper memory offset calculation that crashes the affected system. The CVSS vector confirms network-accessible, zero-authentication exploitation with low complexity, yielding a full availability impact with no confidentiality or integrity exposure. IBM has released a patch; no public exploit code or CISA KEV listing exists at time of analysis.
Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 allows an authenticated local attacker with low-level access to gain elevated (likely root) privileges due to improper privilege management (CWE-269). The CVSS score of 7.8 reflects total confidentiality, integrity, and availability impact upon successful exploitation. No public exploit has been identified at time of analysis, EPSS is extremely low at 0.11% (2nd percentile), and SSVC confirms no observed exploitation, though technical impact is rated total if the flaw is triggered.
Local arbitrary code execution is possible in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 through a TOCTOU race condition (CWE-367), where a low-privileged local attacker can manipulate a resource between its check and its use by a privileged process. The CVSS 7.0 score reflects high confidentiality, integrity, and availability impact, though the high attack complexity (AC:H) indicates the timing window must be won reliably. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; IBM has released a patch via its support advisory.
Remote authenticated exploitation of IBM i versions 7.3 through 7.6 via an out-of-bounds read (CWE-125) enables attackers to both crash the system and exfiltrate sensitive data from adjacent memory regions. The CVSS 8.1 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) reflects significant dual confidentiality and availability impact achievable over the network without user interaction, though a minimum of low-privilege credentials is required, limiting the attack surface to authenticated accounts. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at a low 0.31% (24th percentile), and SSVC rates the attack as non-automatable.
Image policy bypass in IBM Portieris 0.5.0 through 0.14.2 allows remote authenticated attackers to circumvent container image verification controls by exploiting improper authorization of pod owner references (CWE-862). An attacker with low-privilege Kubernetes cluster access can deploy containers from untrusted or unverified images, effectively nullifying the admission controller's entire security enforcement purpose. No public exploit has been identified at time of analysis, but a vendor patch is available via IBM's security advisory.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets an unauthenticated network attacker run arbitrary code by supplying malicious pointers that the OS fails to validate (CWE-843 type confusion). The flaw carries a critical CVSS 9.8 and was disclosed by IBM PSIRT with no user interaction required, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because AIX/VIOS underpins production IBM Power server estates, a working exploit would give attackers full compromise of the affected operating system.
Remote code execution in IBM AIX 7.2 and 7.3, and in the IBM PowerVM VIOS 4.1 virtualization stack, stems from an integer overflow (CWE-190) that a network-based attacker can trigger without authentication or user interaction. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects unauthenticated remote exploitation with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; no EPSS score was supplied in the input.
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 stems from a stack-based buffer overflow that a remote attacker can trigger without authentication, per IBM PSIRT (CVE-2026-16913). With a CVSS 3.1 base of 9.8 (AV:N/AC:L/PR:N/UI:N) and full CIA impact, successful exploitation yields arbitrary code execution on the affected UNIX operating system or virtualization I/O server. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the network-reachable, unauthenticated profile makes this a high-priority patch.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows remote authenticated attackers to execute arbitrary code on affected systems. The flaw (CWE-121) is reachable over the network with low attack complexity and requires only low-privilege credentials, yielding complete confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the 8.8 CVSS score and confirmed RCE potential make patching urgent for organizations running IBM POWER infrastructure.
Remote code execution in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 is enabled by an off-by-one wrap-around error in bounds checking, reachable from an adjacent network without authentication. An attacker positioned on the same network segment can trigger the flaw to achieve full compromise of the affected system - confidentiality, integrity, and availability are all rated High. No public exploit or CISA KEV listing has been identified at time of analysis, but the combination of no-auth adjacency and RCE impact makes this a high-priority patch target in any environment running these IBM platforms.
Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 lets an unauthenticated adjacent-network attacker corrupt memory to achieve arbitrary code execution or crash the affected service (denial of service). The CVSS 3.1 base score is 9.6 (Critical) with a changed scope, reflecting potential impact beyond the vulnerable component on IBM Power hardware. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
Out-of-bounds write in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables an unauthenticated attacker positioned on an adjacent network segment to execute arbitrary code with full confidentiality, integrity, and availability impact. The CWE-787 class flaw requires no privileges and no user interaction, lowering the exploitation bar substantially once network adjacency is achieved. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of zero-prerequisite exploitation and complete system compromise warrants urgent patching in affected enterprise environments.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a stack-based buffer overflow that a network-based attacker can trigger without authentication or user interaction, per the CVSS 9.8 vector. Successful exploitation yields full compromise (high confidentiality, integrity, and availability impact) of Unix systems that frequently underpin enterprise and mission-critical workloads. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.
IBM PowerVM Hypervisor across four active firmware release trains is vulnerable to arbitrary Hostboot memory read and write via the FSP service processor mailbox interface, enabling compromise of the entire host firmware boot stack and the hypervisor subsequently loaded from it. An authenticated attacker holding FSP service-level credentials can send a specially crafted mailbox message that triggers an out-of-bounds memory operation (CWE-125), achieving full confidentiality, integrity, and availability impact against the managed POWER-series system. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the scope change to the hypervisor layer makes this a critical risk for IBM POWER environments with shared or exposed FSP credentials.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an unauthenticated remote attacker to run arbitrary code by triggering a stack-based buffer overflow, per the vendor-assigned CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N. IBM (the reporting party) has published a fix, and no public exploit identified at time of analysis. EPSS and KEV signals were not provided, so the 9.8 CVSS score is currently the strongest available severity indicator.
IBM PowerVM Hypervisor across four firmware trains (FW950 through FW1120) exposes an integer overflow (CWE-190) in its hypervisor call interface that permits a guest partition root user to inject arbitrary quantities of data into hypervisor or co-resident partition memory. The scope change (S:C in CVSS) reflects that exploitation crosses the guest-hypervisor isolation boundary, enabling either a full platform re-IPL that terminates every co-hosted partition or silent corruption of hypervisor and partition memory. No public exploit has been identified at time of analysis, and IBM has released patches covering all affected firmware trains.
Remote OS command injection in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a network attacker to execute arbitrary operating-system commands due to improper neutralization of special elements (CWE-78). The CVSS 3.1 base score is 9.8 with a network, no-privilege, no-interaction vector, and IBM has published a fix. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the combination of unauthenticated remote code execution on enterprise UNIX and virtualization infrastructure makes this a high-priority patch.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables remote authenticated attackers to execute arbitrary code, achieving full compromise of confidentiality, integrity, and availability. The CVSS 8.8 score reflects low-complexity network exploitation requiring only low-privilege authentication (PR:L), making it accessible to any credentialed user on the system. No public exploit identified at time of analysis, but a vendor-released patch is available from IBM.
Shell metacharacter injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a local low-privileged attacker to execute arbitrary OS commands, resulting in complete confidentiality, integrity, and availability compromise per CVSS C:H/I:H/A:H. The root cause (CWE-78) is insufficient sanitization of special shell characters passed to an OS interpreter within an IBM-provided utility or script. IBM has released a patch; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Local privilege escalation in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables a low-privileged authenticated user to gain root access by bypassing RBAC role enforcement. The flaw (CWE-269: Improper Privilege Management) means the operating system fails to correctly enforce the boundaries between assigned RBAC roles, allowing a standard user to assume or exercise privileges reserved for root. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from an out-of-bounds write (CWE-787) that allows a low-privileged local attacker to achieve complete system compromise across confidentiality, integrity, and availability. The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) reflects low-complexity exploitation requiring only a standard local account - a realistic threshold for insider threats or post-exploitation lateral movement within IBM Power environments. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; however, the total C/I/A:H impact on high-value enterprise Unix systems warrants prompt patching.
Remote code execution in IBM PowerVM Hypervisor partition firmware exposes Power Systems environments during network boot operations. An unauthenticated attacker positioned on the same adjacent network as a partition actively performing a network boot can send a malformed packet that triggers a CWE-787 out-of-bounds write, executing arbitrary code within the partition firmware and compromising everything the partition subsequently loads. Impact is scoped to the actively booting partition - other partitions and the managed system are explicitly unaffected. No public exploit or CISA KEV listing exists at time of analysis; EPSS is notably low at 0.19% (9th percentile), consistent with the narrow exploitation window.
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 stems from a stack-based buffer overflow (CWE-121) that a network attacker can trigger without authentication or user interaction. Because the flaw carries a CVSS 9.8 with an AV:N/AC:L/PR:N/UI:N vector, a successful attack yields full compromise of confidentiality, integrity, and availability on affected enterprise UNIX hosts and virtualization I/O servers. There is no public exploit identified at time of analysis, and IBM (the reporter) has released a fix.
Local arbitrary code execution in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 stems from improperly scrubbed environment variables (CWE-426: Untrusted Search Path), allowing a low-privileged local user to inject malicious values such as PATH or LD_PRELOAD that are subsequently consumed by a privileged process. With a CVSS score of 7.8 (HIGH) and full confidentiality, integrity, and availability impact, successful exploitation yields arbitrary code execution at an elevated privilege level. No public exploit or CISA KEV listing has been identified at time of analysis, though a vendor patch is available via IBM support.
Command injection in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables an unauthenticated attacker with adjacent network access to execute arbitrary OS commands, achieving full compromise of confidentiality, integrity, and availability. The adjacent-network attack vector (AV:A) limits exposure to attackers already positioned on the same local network or VLAN as the affected system, which is a meaningful constraint in typical enterprise deployments of these platforms. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis; IBM has released a patch via its support portal.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker overflow a stack buffer (CWE-787 out-of-bounds write) and run arbitrary code on the affected Power-based host. The flaw was reported by IBM, carries a critical 9.8 CVSS rating with a network, no-privilege, no-interaction vector, and a vendor patch is available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a stack buffer overflow (CWE-787) that a network-based attacker can trigger without authentication or user interaction, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). IBM has published a fix, and no public exploit has been identified at time of analysis, though the 9.8 base score reflects full compromise of confidentiality, integrity, and availability. The exact vulnerable service/daemon is not disclosed in the available data, which limits precise attack-surface scoping.
Remote unauthenticated manipulation of network traffic and DNS configuration is possible in IBM AIX 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1, due to improper authentication controls (CWE-287). The CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no user interaction, and no special network positioning - making this accessible to any remote attacker with TCP connectivity to an affected system. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed, but the low attack complexity and high integrity impact make this a meaningful priority for IBM Power Systems environments.
Remote denial of service in IBM AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1 allows an unauthenticated network attacker to crash affected systems by triggering an integer overflow in a network-reachable component. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector confirms full availability loss with no authentication or user interaction required. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog; however, the low attack complexity means opportunistic exploitation is feasible once technical details become public.
Denial of service via use-after-free in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an unauthenticated attacker on an adjacent network to crash affected systems by triggering a memory corruption condition. The scope change (S:C) in the CVSS vector is significant in virtualization contexts: a successful attack against PowerVM VIOS could cascade to hosted virtual machines, amplifying the availability impact beyond the directly targeted component. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is achievable by an unauthenticated attacker on the same network segment via command injection triggered by crafted IPv6 Router Advertisement messages. The vulnerability (CWE-269, Improper Privilege Management) implies the RA processing subsystem executes injected commands with elevated OS-level privileges, enabling full confidentiality, integrity, and availability compromise of the affected host. No public exploit has been identified at time of analysis; IBM has released a patch per advisory https://www.ibm.com/support/pages/node/7283858.
Stack-based buffer overflow in IBM PowerVM Hypervisor's host firmware configuration parsing allows authenticated service-level access holders to crash the firmware boot stack with possible memory corruption during system initialization, impacting integrity and availability of the managed Power system. Affected firmware spans three release trains: FW1060.00-FW1060.80, FW1110.00-FW1110.30, and FW1120.00. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; IBM has released a patch via advisory at https://www.ibm.com/support/pages/node/7283238.
Arbitrary command execution against IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 is possible by an unauthenticated attacker on the same network segment who can deliver DHCP option values containing unescaped shell metacharacters to the system's DHCP client. The DHCP client fails to neutralize these metacharacters before passing option data to shell processing (CWE-78), enabling full confidentiality, integrity, and availability compromise of the target host. A vendor patch is available via IBM support, and no public exploit or CISA KEV listing has been identified at time of analysis.
Network boot exploitation in IBM PowerVM Hypervisor across firmware branches FW950, FW1060, FW1110, and FW1120 allows an unauthenticated attacker with adjacent-network access to disrupt or hijack the boot sequence of any partition performing a PXE/network boot. Under the default configuration where OS secure boot is disabled, the attacker can substitute the boot image entirely, compromising the OS and all subsequently loaded software for that partition. No active exploitation has been confirmed per SSVC and EPSS signals, but the default-configuration exposure and full partition compromise potential make this a meaningful priority for IBM Power Systems operators.
Heap buffer overflow in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 enables unauthenticated adjacent-network attackers to execute arbitrary code on affected systems. The CWE-787 out-of-bounds write flaw carries a CVSS score of 8.8 and yields full confidentiality, integrity, and availability compromise upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis; however, a vendor-supplied patch is available via IBM support advisory node/7283858.
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a heap buffer overflow (CWE-787 out-of-bounds write) in an affected network-facing component. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated, low-complexity network exploitation with full confidentiality, integrity, and availability impact. IBM has published a fix; no public exploit identified at time of analysis and no CISA KEV listing, so this is currently a high-severity but not confirmed-exploited issue.
OS command injection in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables an unauthenticated attacker with adjacent network access to execute arbitrary operating system commands without any user interaction. The flaw (CWE-78) resides in a network-exposed component that fails to neutralize shell metacharacters before incorporating user-supplied input into OS commands, granting full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, but a vendor patch is available via IBM support advisory.
OS command injection in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 allows an adjacent network attacker without credentials to execute arbitrary operating system commands. The flaw (CWE-78) arises from improper neutralization of special elements passed to OS command constructors, exposing the full confidentiality, integrity, and availability of affected hosts. No public exploit or CISA KEV listing has been identified at time of analysis, though a vendor patch is available via IBM Support.
Stack buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables unauthenticated remote code execution by any attacker with adjacent network access. The flaw (CWE-787, Out-of-bounds Write) corrupts stack memory during processing of a crafted network payload, allowing an attacker to overwrite return addresses and redirect execution without requiring credentials or user interaction. No public exploit has been identified at time of analysis and IBM has released a patch, but the AV:A/PR:N/AC:L vector makes this a high-priority fix for any organization running IBM Power Systems infrastructure.
Remote code execution in IBM PowerVM Hypervisor firmware versions FW950 through FW1120 allows an attacker with authenticated service-level access to the Flexible Service Processor (FSP) to execute arbitrary code in the host firmware runtime and gain full control of the managed Power system. An integer overflow (CWE-190) in the service processor mailbox interface is the root cause, with CVSS scope change (S:C) reflecting that exploitation breaks out from the FSP boundary into the broader host firmware and managed-system context. No public exploit or CISA KEV listing exists at time of analysis; however, the combination of complete C/I/A impact and scope change makes this a high-priority patch target for any organization running affected IBM Power hardware.
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering an out-of-bounds write (CWE-787) in an affected component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates the flaw is reachable over the network by unauthenticated attackers with low complexity, yielding full compromise of confidentiality, integrity, and availability. IBM has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote information disclosure in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from an integer underflow in the kernel's IPv4 IP-options parser (CWE-125 out-of-bounds read), letting a remote attacker leak sensitive memory contents by sending crafted IP packets. IBM (the reporting vendor) rates it CVSS 9.4, and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
TOCTOU race condition in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 permits a local, low-privileged user to overwrite critical system files or extract sensitive information by exploiting the timing gap between a file-check and file-use operation. The attack is constrained to local access with high exploitation complexity, yet the potential impact spans full confidentiality, integrity, and availability compromise of the affected system. No public exploit or CISA KEV listing exists at time of analysis; IBM has released a vendor patch.
Remote denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows unauthenticated network attackers to crash or exhaust resources in the SSL subsystem by omitting an expected client certificate during the TLS handshake. The CVSS 7.5 rating (AV:N/AC:L/PR:N/UI:N) confirms low attack complexity with no authentication required, making exploitation straightforward against any exposed SSL service on affected systems. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the patch is available and should be prioritized for internet-facing AIX and VIOS deployments.
Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables unauthenticated remote attackers to exhaust system resources via network-delivered input, fully disabling availability (CVSS A:H) without any confidentiality or integrity impact. The vulnerability is rooted in CWE-400 uncontrolled resource consumption, triggered from the network with no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N). No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available from IBM.
Denial of service in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker crash or hang the affected system by triggering an integer underflow (CWE-190) in a network-reachable component. The flaw was reported by IBM, which has released a fix; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. Note that IBM's published CVSS 9.8 claims full confidentiality/integrity/availability impact, which conflicts with the description's DoS-only wording.
Denial of service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 allows unauthenticated remote attackers to exhaust system resources and render affected systems unavailable by sending crafted network input that triggers uncontrolled resource consumption (CWE-400). The CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms low-complexity, unauthenticated remote exploitability with a high availability impact. No active exploitation has been confirmed in CISA KEV, and no public exploit code is known at time of analysis; a vendor patch is available via IBM's support portal.
Unbounded recursion in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 exposes these systems to remote denial-of-service attacks requiring no authentication or user interaction. Network-reachable attackers can trigger uncontrolled resource consumption, exhausting stack or memory resources and disrupting availability of affected systems. No public exploit code has been identified and CISA KEV does not list this vulnerability; a vendor-released patch is available via IBM's support portal.
TNC policy server impersonation in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a network-positioned attacker forge the Trusted Network Connect policy server and tamper with the traffic between it and the endpoint, because the client fails to properly validate the server's certificate (CWE-295). An attacker who can intercept the session can present a fraudulent certificate, read limited data and alter integrity-critical policy exchanges. IBM has released a fix; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Full host-system memory access in IBM Power Systems Firmware allows a privileged BMC/FSP attacker to read and write arbitrary regions of host memory, yielding complete control over the host and all hosted logical partitions. Affected firmware spans multiple generations including FW1120.00, FW1110.x, FW1060.x, FW950.x, and OP940.x lines covering Power9 and Power HMC platforms. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, though the scope-changing impact (S:C) and full C/I/A triad make this a critical priority for any environment where BMC/FSP access is not tightly controlled.
Memory corruption and persistent denial-of-service in IBM Power Systems Firmware exposes OpenPOWER environments to host-level crashes triggered from guest partitions. An attacker holding root access within a guest partition can write a specially crafted NVRAM image that causes the host firmware boot stage to crash with possible memory corruption, taking down the managed system until an operator manually clears NVRAM via the service processor. No public exploit code has been identified and no active exploitation is confirmed, but the persistence of the availability impact and the cross-boundary scope change (guest-to-host) make this a meaningful risk in shared multi-tenant OpenPOWER environments.
IBM Power Systems Firmware across three firmware branches exposes a privilege escalation path across the BMC/FSP-to-host boundary, allowing an attacker already holding service account or root credentials on the Flexible Service Processor to read and disrupt host processor state, cascading impact to all logical partitions (LPARs) hosted on the managed system. The scope change confirmed in the CVSS vector (S:C) distinguishes this from a typical local privilege issue: exploitation crosses the management-plane isolation barrier and can affect production workloads running on every partition. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Remote code execution in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950.H2) lets an unauthenticated attacker with adjacent-network access to the ASMI web interface send a malformed request that overflows a stack buffer on the Flexible Service Processor (FSP), yielding arbitrary code execution and full control of the managed system. Because the FSP is the service processor beneath the OS, compromise crosses a scope boundary (CVSS S:C) and breaks confidentiality, integrity, and availability of the whole platform. No public exploit identified at time of analysis; IBM has released a fix and reported the issue itself.
Authentication bypass in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950.H2) lets an unauthenticated attacker positioned on the Flexible Service Processor (FSP) management network assume full administrative control of the managed system. An attacker can manipulate partition power state, alter configuration, and access partition consoles across every hosted LPAR, yielding complete confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the flaw is not on CISA KEV, but the 9.6 CVSS and scope-changing impact make it a high-priority patch for datacenters running IBM Power hardware.
Remote code execution in IBM Power Systems Firmware is possible via a stack-based buffer overflow (CWE-121) in the FSP management network protocol. An attacker holding authenticated HMC administrator credentials and adjacent-network access to the management interface can trigger the overflow to execute arbitrary code on the Flexible Service Processor, achieving full out-of-band control over all managed hardware and hosted workloads. No public exploit code and no CISA KEV listing are confirmed at time of analysis; the vendor has released a patch.
Cross-site request forgery in IBM Power Systems Firmware's ASMI web interface allows a network-based attacker to silently execute arbitrary administrative actions against the Flexible Service Processor (FSP) by tricking a logged-in ASMI administrator into visiting a crafted page. Affected versions span four major firmware branches - FW950, FW1060, FW1110, and FW1120 - covering a broad range of IBM Power hardware in production. No public exploit identified at time of analysis, though the high integrity and availability impact against firmware-level management infrastructure makes this a significant risk for affected organizations.
Unauthenticated crash and possible memory corruption in the IBM Power Systems ASMI web interface exposes multiple firmware release trains (FW950, FW1060, FW1110, FW1120) to repeated denial of out-of-band management access. An attacker present on the management network can trigger ASMI web server crashes without credentials, and sustained repeated exploitation can lock administrators out of the ASMI interface entirely - though hosted logical partitions remain unaffected. No public exploit code has been identified at time of analysis, and IBM has issued a patch via advisory 7283898.
Arbitrary code execution on IBM Power Systems host environments is achievable by an attacker with service-level access to the Baseboard Management Controller (BMC), exploiting a stack-based buffer overflow (CWE-121) in the BMC-to-host communication interface. Affected firmware versions FW1120.00 and FW1110.00 through FW1110.30 are vulnerable; successful exploitation yields full control over the host system and all hosted logical partitions (LPARs), resulting in complete confidentiality, integrity, and availability compromise across all co-located workloads. No public exploit has been identified at time of analysis, and the CVE is not currently listed in the CISA KEV catalog; IBM has released a remediation patch via advisory at https://www.ibm.com/support/pages/node/7283220.
Full takeover of IBM Power Systems host partitions and all hosted logical partitions (LPARs) is achievable by any actor holding service account or root credentials on the BMC or FSP management controller across multiple IBM Power firmware generations. The flaw (CWE-863, Incorrect Authorization) permits writing arbitrary data to hardware control registers via the BMC/FSP-to-host interface, collapsing the security boundary between the out-of-band management plane and every workload running on the system. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV; IBM has released a firmware patch via support advisory 7283218.