CVE-2026-15065: Vulnerabilities in IBM AIX and PowerVM VIOS

Q: Which systems are exposed?

IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 systems using NIM, are identified as affected. Exposure arises from an update file that is publicly available.

Q: What does an attacker need to exploit this issue?

The issue is remotely exploitable with low attack complexity and requires no privileges or user interaction. The disclosed intermediate certificate authority private keys could be used to bypass security restrictions.

Q: What is the likely impact?

The vulnerability has critical severity with a 9.1 score. It is assessed as having high confidentiality and integrity impact, with no availability impact.

Published Aug 15, 2026

Updated

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass security restrictions due to the exposure of intermediate certificate authority private keys in a publicly available update file.

Other sources

IBM AIX NIM could allow a remote attacker to bypass security restrictions due to the exposure of intermediate certificate authority private keys in a publicly available update file.

— IBM

Affected Software

10 affected components

IBM AIX<=7.2

IBM AIX<=7.3

IBM PowerVM VIOS<=4.1

IBM VIOS>=4.1.0<4.1.0.50

IBM VIOS>=4.1.1.0<4.1.1.30

IBM VIOS>=4.1.2.0<4.1.2.20

IBM AIX>=7.2.5<=7.2.5.212

IBM AIX>=7.3.2<=7.3.2.5

IBM AIX>=7.3.3<=7.3.3.2

IBM AIX>=7.3.4<=7.3.4.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM PowerVM VIOS 4.1.0 to a version that resolves this vulnerability.
Fixed in 4.1.0.50
Upgrade
Upgrade IBM PowerVM VIOS 4.1.1 to a version that resolves this vulnerability.
Fixed in 4.1.1.30
Upgrade
Upgrade IBM PowerVM VIOS 4.1.2 to a version that resolves this vulnerability.
Fixed in 4.1.2.20
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch IJ5956508
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch IJ5956408
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch IJ5956308
Compensating control
For VIOS 4.1.0 and VIOS 4.1.1 after applying the 4.1.0.50 or 4.1.1.30 FPs above, perform the additional required steps to migrate to the latest Postgres15.
Operational
An LPAR reboot is required to complete the SP/FP update.

Event History

Aug 15, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Aug 19, 2026

CVE Published

via MITRE·02:33 PM

Data Sourced

via MITRE·02:33 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-7283858

Frequently Asked Questions

Which systems are exposed?

IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 systems using NIM, are identified as affected. Exposure arises from an update file that is publicly available.

What does an attacker need to exploit this issue?

The issue is remotely exploitable with low attack complexity and requires no privileges or user interaction. The disclosed intermediate certificate authority private keys could be used to bypass security restrictions.

What is the likely impact?

The vulnerability has critical severity with a 9.1 score. It is assessed as having high confidentiality and integrity impact, with no availability impact.

CVE-2026-15065: Vulnerabilities in IBM AIX and PowerVM VIOS

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Which systems are exposed?

What does an attacker need to exploit this issue?

What is the likely impact?

Company

Resources

Contact