CVE-2026-15061: Vulnerabilities in IBM AIX and PowerVM VIOS
AIX's nimesis registration service could allow a remote attacker to overwrite files due to path traversal.
Other sources
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 's nimesis registration service could allow a remote attacker to overwrite files due to path traversal.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.0.50Patch IJ5956508/14/2026 - Upgrade
Upgrade
IBM PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.1.30Patch IJ5956408/14/2026 - Upgrade
Upgrade
IBM PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.2.20Patch IJ5956308/14/2026 - Operational
Perform an LPAR reboot after completing the SP/FP update to complete the AIX/VIOS update.
- Operational
For VIOS 4.1.0 and VIOS 4.1.1, after applying the 4.1.0.50 or 4.1.1.30 FPs, migrate to the latest Postgres15 as additional required steps.
Event History
Frequently Asked Questions
Which systems are in scope?
IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1, are identified as affected through the nimesis registration service. The provided information does not state whether the service is enabled by default.
What access does an attacker need?
The CVSS vector indicates network-based exploitation with low attack complexity. It requires no privileges and no user interaction.
What could successful exploitation do?
A remote attacker could overwrite files through path traversal in the nimesis registration service. The reported impact is high to integrity, low to availability, and none to confidentiality.