Powervm Vios

Path traversal in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 exposes sensitive files to remote, unauthenticated attackers over the network. The flaw (CWE-22) allows directory traversal sequences to escape an intended path boundary, enabling read access to files that should not be externally accessible. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.

Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an unauthenticated remote attacker to run arbitrary code by triggering a stack-based buffer overflow, per the vendor-assigned CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N. IBM (the reporting party) has published a fix, and no public exploit identified at time of analysis. EPSS and KEV signals were not provided, so the 9.8 CVSS score is currently the strongest available severity indicator.

Out-of-bounds memory read in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 exposes sensitive system memory to locally authenticated users holding low-privilege accounts. The flaw (CWE-125) allows an attacker with existing local access to read memory contents beyond intended buffer boundaries, producing high confidentiality impact while leaving system integrity and availability unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via advisory 7283858.

Remote OS command injection in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a network attacker to execute arbitrary operating-system commands due to improper neutralization of special elements (CWE-78). The CVSS 3.1 base score is 9.8 with a network, no-privilege, no-interaction vector, and IBM has published a fix. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the combination of unauthenticated remote code execution on enterprise UNIX and virtualization infrastructure makes this a high-priority patch.

Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables remote authenticated attackers to execute arbitrary code, achieving full compromise of confidentiality, integrity, and availability. The CVSS 8.8 score reflects low-complexity network exploitation requiring only low-privilege authentication (PR:L), making it accessible to any credentialed user on the system. No public exploit identified at time of analysis, but a vendor-released patch is available from IBM.

Shell metacharacter injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a local low-privileged attacker to execute arbitrary OS commands, resulting in complete confidentiality, integrity, and availability compromise per CVSS C:H/I:H/A:H. The root cause (CWE-78) is insufficient sanitization of special shell characters passed to an OS interpreter within an IBM-provided utility or script. IBM has released a patch; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Local privilege escalation in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables a low-privileged authenticated user to gain root access by bypassing RBAC role enforcement. The flaw (CWE-269: Improper Privilege Management) means the operating system fails to correctly enforce the boundaries between assigned RBAC roles, allowing a standard user to assume or exercise privileges reserved for root. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.

Local privilege escalation in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from an out-of-bounds write (CWE-787) that allows a low-privileged local attacker to achieve complete system compromise across confidentiality, integrity, and availability. The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) reflects low-complexity exploitation requiring only a standard local account - a realistic threshold for insider threats or post-exploitation lateral movement within IBM Power environments. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; however, the total C/I/A:H impact on high-value enterprise Unix systems warrants prompt patching.

Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 stems from a stack-based buffer overflow (CWE-121) that a network attacker can trigger without authentication or user interaction. Because the flaw carries a CVSS 9.8 with an AV:N/AC:L/PR:N/UI:N vector, a successful attack yields full compromise of confidentiality, integrity, and availability on affected enterprise UNIX hosts and virtualization I/O servers. There is no public exploit identified at time of analysis, and IBM (the reporter) has released a fix.

Local arbitrary code execution in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 stems from improperly scrubbed environment variables (CWE-426: Untrusted Search Path), allowing a low-privileged local user to inject malicious values such as PATH or LD_PRELOAD that are subsequently consumed by a privileged process. With a CVSS score of 7.8 (HIGH) and full confidentiality, integrity, and availability impact, successful exploitation yields arbitrary code execution at an elevated privilege level. No public exploit or CISA KEV listing has been identified at time of analysis, though a vendor patch is available via IBM support.

Out-of-bounds read (CWE-125) in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 exposes a remotely reachable attack surface that allows unauthenticated network attackers to cause a denial of service under high-complexity conditions. The CVSS vector also records a limited integrity impact (I:L), which is inconsistent with the description's exclusive mention of denial of service and warrants verification against the vendor advisory. No public exploit code or active exploitation has been identified; a vendor patch is available from IBM.

Command injection in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables an unauthenticated attacker with adjacent network access to execute arbitrary OS commands, achieving full compromise of confidentiality, integrity, and availability. The adjacent-network attack vector (AV:A) limits exposure to attackers already positioned on the same local network or VLAN as the affected system, which is a meaningful constraint in typical enterprise deployments of these platforms. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis; IBM has released a patch via its support portal.

Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker overflow a stack buffer (CWE-787 out-of-bounds write) and run arbitrary code on the affected Power-based host. The flaw was reported by IBM, carries a critical 9.8 CVSS rating with a network, no-privilege, no-interaction vector, and a vendor patch is available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a stack buffer overflow (CWE-787) that a network-based attacker can trigger without authentication or user interaction, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). IBM has published a fix, and no public exploit has been identified at time of analysis, though the 9.8 base score reflects full compromise of confidentiality, integrity, and availability. The exact vulnerable service/daemon is not disclosed in the available data, which limits precise attack-surface scoping.

Remote unauthenticated manipulation of network traffic and DNS configuration is possible in IBM AIX 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1, due to improper authentication controls (CWE-287). The CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no user interaction, and no special network positioning - making this accessible to any remote attacker with TCP connectivity to an affected system. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed, but the low attack complexity and high integrity impact make this a meaningful priority for IBM Power Systems environments.

Heap buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables a local low-privileged attacker to crash the system, resulting in a denial of service. The flaw is rooted in improper bounds checking during heap memory operations (CWE-787). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, a vendor-released patch is available via IBM advisory node/7283858.

Remote denial of service in IBM AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1 allows an unauthenticated network attacker to crash affected systems by triggering an integer overflow in a network-reachable component. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector confirms full availability loss with no authentication or user interaction required. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog; however, the low attack complexity means opportunistic exploitation is feasible once technical details become public.

Denial of service via use-after-free in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an unauthenticated attacker on an adjacent network to crash affected systems by triggering a memory corruption condition. The scope change (S:C) in the CVSS vector is significant in virtualization contexts: a successful attack against PowerVM VIOS could cascade to hosted virtual machines, amplifying the availability impact beyond the directly targeted component. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.

Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is achievable by an unauthenticated attacker on the same network segment via command injection triggered by crafted IPv6 Router Advertisement messages. The vulnerability (CWE-269, Improper Privilege Management) implies the RA processing subsystem executes injected commands with elevated OS-level privileges, enabling full confidentiality, integrity, and availability compromise of the affected host. No public exploit has been identified at time of analysis; IBM has released a patch per advisory https://www.ibm.com/support/pages/node/7283858.

Denial of service in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 is achievable by unauthenticated remote attackers positioned on an adjacent network segment, exploiting an improper array index boundary check (CWE-129). The flaw allows a crafted network request to trigger an out-of-bounds array access, crashing or degrading availability of the affected system. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept has been identified at time of analysis; a vendor patch is available via IBM Support.

Arbitrary command execution against IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 is possible by an unauthenticated attacker on the same network segment who can deliver DHCP option values containing unescaped shell metacharacters to the system's DHCP client. The DHCP client fails to neutralize these metacharacters before passing option data to shell processing (CWE-78), enabling full confidentiality, integrity, and availability compromise of the target host. A vendor patch is available via IBM support, and no public exploit or CISA KEV listing has been identified at time of analysis.

Heap buffer overflow in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 enables unauthenticated adjacent-network attackers to execute arbitrary code on affected systems. The CWE-787 out-of-bounds write flaw carries a CVSS score of 8.8 and yields full confidentiality, integrity, and availability compromise upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis; however, a vendor-supplied patch is available via IBM support advisory node/7283858.

Denial of service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 is achievable by an adjacent-network attacker exploiting a null pointer dereference, capable of crashing the targeted system without requiring authentication or user interaction. The vulnerability affects IBM's enterprise UNIX operating system and its PowerVM Virtual I/O Server layer, where availability is operationally critical for hosted workloads. No public exploit code has been identified at time of analysis, and IBM has released a remediation patch via official advisory.

Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering a heap buffer overflow (CWE-787 out-of-bounds write) in an affected network-facing component. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated, low-complexity network exploitation with full confidentiality, integrity, and availability impact. IBM has published a fix; no public exploit identified at time of analysis and no CISA KEV listing, so this is currently a high-severity but not confirmed-exploited issue.

OS command injection in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables an unauthenticated attacker with adjacent network access to execute arbitrary operating system commands without any user interaction. The flaw (CWE-78) resides in a network-exposed component that fails to neutralize shell metacharacters before incorporating user-supplied input into OS commands, granting full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, but a vendor patch is available via IBM support advisory.

OS command injection in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 allows an adjacent network attacker without credentials to execute arbitrary operating system commands. The flaw (CWE-78) arises from improper neutralization of special elements passed to OS command constructors, exposing the full confidentiality, integrity, and availability of affected hosts. No public exploit or CISA KEV listing has been identified at time of analysis, though a vendor patch is available via IBM Support.

Stack buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables unauthenticated remote code execution by any attacker with adjacent network access. The flaw (CWE-787, Out-of-bounds Write) corrupts stack memory during processing of a crafted network payload, allowing an attacker to overwrite return addresses and redirect execution without requiring credentials or user interaction. No public exploit has been identified at time of analysis and IBM has released a patch, but the AV:A/PR:N/AC:L vector makes this a high-priority fix for any organization running IBM Power Systems infrastructure.

Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering an out-of-bounds write (CWE-787) in an affected component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates the flaw is reachable over the network by unauthenticated attackers with low complexity, yielding full compromise of confidentiality, integrity, and availability. IBM has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Remote information disclosure in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from an integer underflow in the kernel's IPv4 IP-options parser (CWE-125 out-of-bounds read), letting a remote attacker leak sensitive memory contents by sending crafted IP packets. IBM (the reporting vendor) rates it CVSS 9.4, and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

TOCTOU race condition in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 permits a local, low-privileged user to overwrite critical system files or extract sensitive information by exploiting the timing gap between a file-check and file-use operation. The attack is constrained to local access with high exploitation complexity, yet the potential impact spans full confidentiality, integrity, and availability compromise of the affected system. No public exploit or CISA KEV listing exists at time of analysis; IBM has released a vendor patch.

Remote denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows unauthenticated network attackers to crash or exhaust resources in the SSL subsystem by omitting an expected client certificate during the TLS handshake. The CVSS 7.5 rating (AV:N/AC:L/PR:N/UI:N) confirms low attack complexity with no authentication required, making exploitation straightforward against any exposed SSL service on affected systems. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the patch is available and should be prioritized for internet-facing AIX and VIOS deployments.

Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables unauthenticated remote attackers to exhaust system resources via network-delivered input, fully disabling availability (CVSS A:H) without any confidentiality or integrity impact. The vulnerability is rooted in CWE-400 uncontrolled resource consumption, triggered from the network with no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N). No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available from IBM.

Denial of service in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker crash or hang the affected system by triggering an integer underflow (CWE-190) in a network-reachable component. The flaw was reported by IBM, which has released a fix; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. Note that IBM's published CVSS 9.8 claims full confidentiality/integrity/availability impact, which conflicts with the description's DoS-only wording.

Kernel memory disclosure in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 exposes internal kernel memory to remote unauthenticated attackers via an out-of-bounds read (CWE-125). The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N confirms network-accessible, zero-prerequisite exploitation, though impact is bounded to partial confidentiality loss with no integrity or availability consequences. No public exploit or active exploitation has been identified at time of analysis; IBM has released a patch via advisory at https://www.ibm.com/support/pages/node/7283858.

Denial of service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 allows unauthenticated remote attackers to exhaust system resources and render affected systems unavailable by sending crafted network input that triggers uncontrolled resource consumption (CWE-400). The CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms low-complexity, unauthenticated remote exploitability with a high availability impact. No active exploitation has been confirmed in CISA KEV, and no public exploit code is known at time of analysis; a vendor patch is available via IBM's support portal.

Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is achievable by an adjacent-network attacker through a NULL pointer dereference in a network-handling code path. Exploitation requires no authentication but demands high attack complexity, substantially limiting opportunistic or internet-scale attacks. IBM has released a patch via its official support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.

Denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 can be triggered by a remote, unauthenticated attacker exploiting an uninitialized stack pointer (CWE-908), leading to system unavailability. The CVSS vector scores high attack complexity (AC:H), indicating that successful exploitation requires specific conditions or timing rather than a straightforward network request. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.

Out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote authenticated attackers to trigger memory corruption leading to partial information disclosure and denial of service. The flaw (CWE-787) requires low-privilege credentials and high attack complexity, placing it at CVSS 4.2 Medium - a realistic but bounded threat profile. No public exploit code or active exploitation is confirmed at time of analysis; IBM has released a vendor patch via advisory at https://www.ibm.com/support/pages/node/7283858.

Unbounded recursion in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 exposes these systems to remote denial-of-service attacks requiring no authentication or user interaction. Network-reachable attackers can trigger uncontrolled resource consumption, exhausting stack or memory resources and disrupting availability of affected systems. No public exploit code has been identified and CISA KEV does not list this vulnerability; a vendor-released patch is available via IBM's support portal.

TNC policy server impersonation in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a network-positioned attacker forge the Trusted Network Connect policy server and tamper with the traffic between it and the endpoint, because the client fails to properly validate the server's certificate (CWE-295). An attacker who can intercept the session can present a fraudulent certificate, read limited data and alter integrity-critical policy exchanges. IBM has released a fix; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 expose a local denial-of-service condition through improper handling of memory page table configurations (CWE-400), allowing a low-privileged local attacker to exhaust critical kernel resources and crash or hang the system. The CVSS scope-change flag (S:C) is particularly significant in PowerVM VIOS deployments, where a triggered kernel fault in the Virtual I/O Server could cascade to affect co-hosted guest partitions or the hypervisor layer itself. IBM has released a patch via their support portal; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

IBM AIX 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, expose a time-of-check time-of-use (TOCTOU) race condition that local, unprivileged attackers can exploit to corrupt data integrity or crash the system. The flaw requires only local shell access with no privileges, making it exploitable by any local user account on affected POWER-architecture systems. No public exploit code or CISA KEV listing exists at time of analysis, though a vendor patch is available.

Uncontrolled resource consumption in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 exposes these systems to remote denial-of-service attacks requiring no authentication or user interaction. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms any network-reachable attacker can trigger availability loss without special privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and a vendor patch is available.

IBM AIX 7.2 and 7.3, and PowerVM VIOS 4.1 expose an unauthenticated remote denial-of-service condition rooted in a NULL pointer dereference. A remote attacker with no credentials or user interaction can crash affected network-accessible components, resulting in complete availability loss (A:H) with no confidentiality or integrity impact. No public exploit code or active exploitation has been confirmed at time of analysis, and IBM has released a patch via advisory https://www.ibm.com/support/pages/node/7283858.

OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute arbitrary operating-system commands due to improper neutralization of special elements (CWE-78). Rated CVSS 9.9 with a scope change, a successful low-privilege attacker can break out of the application context and run commands on the underlying enterprise Unix host, threatening confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and network reachability make it a high-priority patch.

Heap buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables unauthenticated remote code execution by attackers positioned on an adjacent network segment, with no user interaction required. The flaw (CWE-787, out-of-bounds write) results in full compromise of confidentiality, integrity, and availability of the affected system. A vendor patch has been released via IBM advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.

Remote denial-of-service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 is caused by a CWE-787 out-of-bounds write reachable by unauthenticated network attackers with no complexity prerequisites. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects straightforward remote triggering with high availability impact but no confidentiality or integrity consequence. IBM has released a patch via the vendor advisory; no public exploit code has been identified at time of analysis.

Local privilege escalation in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows an authenticated low-privileged user to gain full elevated privileges due to improper privilege management (CWE-269). The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that any standard local user account is sufficient to trigger the flaw with low complexity and no user interaction, resulting in complete confidentiality, integrity, and availability compromise of the affected system. No public exploit identified at time of analysis, and a vendor patch is available via IBM advisory.

Remote denial-of-service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables an unauthenticated network attacker to exhaust system resources and crash or severely degrade affected hosts. The root cause is uncontrolled resource consumption (CWE-400), exploitable without authentication or user interaction via a network-accessible service. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch addressed in advisory node/7283858.

Unauthenticated remote access to NFS-exported filesystems is possible in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 due to improper authentication (CWE-287). The CVSS vector AV:N/AC:L/PR:N/UI:N confirms that unauthenticated remote attackers on the network can exploit this with low complexity and no user interaction, gaining high-confidence read access and limited write access to exported filesystem data. No public exploit has been identified at time of analysis, and IBM has released a patch via advisory 7283858.

Remote denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is exploitable by unauthenticated attackers who send malformed client registration packets to the NIM (Network Installation Manager) server, triggering a classic buffer overflow that crashes the nimserver daemon. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms low-complexity, network-accessible exploitation requiring no privileges, though impact is strictly limited to availability - no confidentiality or integrity exposure is present. IBM has released a patch via support advisory 7283858; no public exploit code has been identified and this vulnerability does not appear on the CISA KEV catalog at time of analysis.

Remote privilege escalation to root in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 stems from an improper authentication weakness (CWE-287) that lets an unauthenticated network attacker bypass identity checks and obtain root-level control. The CVSS 9.8 rating reflects a network-reachable, low-complexity flaw requiring no privileges or user interaction, with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the severity and unauthenticated network vector make it a high-priority patching target for IBM Power estates.

Improper TLS certificate validation in the NIM (Network Installation Management) subsystem of IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 enables remote attackers to gain unauthorized access to AIX systems by exploiting the failure to verify certificate authenticity during NIM communications. The CVSS 8.1 High score reflects high confidentiality and integrity impact across a network-exploitable path with low complexity and no user interaction required. No public exploit identified at time of analysis, but the authentication bypass classification of this flaw makes it a meaningful privilege escalation and lateral movement risk in IBM Power environments.

OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands through the Network Installation Manager (NIM) component. Because NIM typically operates with high (often root-level) privilege and the CVSS scope is Changed, successful exploitation can compromise the underlying operating system with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the 9.9 base score and low attack complexity make it a high-priority patch for IBM Power estates.

Sensitive-key exposure in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 Network Installation Management (NIM) leaks intermediate certificate authority (CA) private keys inside a publicly downloadable update file, letting remote attackers forge trusted certificates and bypass security restrictions. Rated CVSS 9.1, the flaw impacts confidentiality and integrity (C:H/I:H) but not availability, and IBM has released a fix. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the ease of obtaining a live CA key makes this a high-priority credential-hygiene issue.

Unauthenticated remote file overwrite in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is possible via the nimesis registration service, which fails to sanitize path traversal sequences in client-supplied input. An attacker with network access to the nimesis service can write arbitrary content to locations outside the intended directory, potentially overwriting sensitive system files such as cron jobs, init scripts, or authentication databases. No public exploit or active exploitation has been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is straightforwardly exploitable without authentication.