CVE-2026-15068: Vulnerabilities in IBM AIX and PowerVM VIOS
AIX NIM could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
Other sources
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM AIXto a version that resolves this vulnerability.Fixed in 7.3 TL02SP5 - Upgrade
Upgrade
IBM AIXto a version that resolves this vulnerability.Fixed in 7.3 TL03SP3 - Upgrade
Upgrade
IBM AIXto a version that resolves this vulnerability.Fixed in 7.3 TL04SP2 - Upgrade
Upgrade
IBM PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.0.50Patch IJ5956508 - Upgrade
Upgrade
IBM PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.1.30Patch IJ5956408 - Upgrade
Upgrade
IBM PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.2.20Patch IJ5956308 - Compensating control
Apply the assigned VIOS 4.1.0.50 / 4.1.1.30 / 4.1.2.20 and AIX SP remediations using the secure NIM approach (nimsh secure) with the special steps noted in the provided IBM article, since the protocol between master and client is updated to be more secure.
- Operational
After applying the AIX Service Pack/VIOS Fix Pack updates, reboot the LPAR to complete the SP/FP update.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker must be remote and authenticated, and exploitation does not require user interaction. The attack complexity is low.
Which deployments are identified as affected?
The affected products named are IBM AIX 7.2, IBM AIX 7.3, and IBM PowerVM VIOS 4.1 NIM. The provided information does not state whether any default configuration is affected.
What is the potential impact of successful exploitation?
A successful attacker could execute arbitrary operating-system commands. The supplied severity vector indicates high confidentiality, integrity, and availability impact, with scope changed.