CVE-2026-15065: Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass security restrictions due to the exposure of intermediate certificate authority private keys in a publicly available update file.
Other sources
IBM AIX NIM could allow a remote attacker to bypass security restrictions due to the exposure of intermediate certificate authority private keys in a publicly available update file.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM AIX 7.2 (TL/SP)to a version that resolves this vulnerability.Patch SPKEY7.2.5 - Upgrade
Upgrade
IBM PowerVM VIOS 4.1.0to a version that resolves this vulnerability.Fixed in 4.1.0.50Patch key_w_apar - Upgrade
Upgrade
IBM PowerVM VIOS 4.1.1to a version that resolves this vulnerability.Fixed in 4.1.1.30Patch key_w_apar - Upgrade
Upgrade
IBM PowerVM VIOS 4.1.2to a version that resolves this vulnerability.Fixed in 4.1.2.20Patch key_w_apar - Operational
Reboot the LPAR after applying the AIX Service Pack / VIOS Fix Pack update to complete the SP/FP update (explicitly required in the post-update instructions).
- Operational
For VIOS 4.1.0 and VIOS 4.1.1, perform the additional steps required to migrate to the latest Postgres15 after applying the 4.1.0.50 or 4.1.1.30 FPs, respectively.
Event History
Frequently Asked Questions
Which systems are exposed?
IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 systems using NIM, are identified as affected. Exposure arises from an update file that is publicly available.
What does an attacker need to exploit this issue?
The issue is remotely exploitable with low attack complexity and requires no privileges or user interaction. The disclosed intermediate certificate authority private keys could be used to bypass security restrictions.
What is the likely impact?
The vulnerability has critical severity with a 9.1 score. It is assessed as having high confidentiality and integrity impact, with no availability impact.