CVE-2026-15068: Vulnerabilities in IBM AIX and PowerVM VIOS
AIX NIM could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
Other sources
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.0.50 - Upgrade
Upgrade
IBM PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.1.30Patch key_w_apar4.1.1IJ5956408/14/2026 - Upgrade
Upgrade
IBM PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.2.20Patch key_w_apar4.1.2IJ5956308/14/2026 - Compensating control
If using nimsh secure to apply AIX/VIOS patches, follow the special steps required because the protocol between master and client is updated to be more secure.
- Operational
For the SP/FP update, perform an LPAR reboot to complete the SP/FP update.
- Operational
For VIOS 4.1.0 and VIOS 4.1.1, after applying the 4.1.0.50 or 4.1.1.30 FPs, complete the additional steps required to migrate to the latest Postgres15.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker must be remote and authenticated, and exploitation does not require user interaction. The attack complexity is low.
Which deployments are identified as affected?
The affected products named are IBM AIX 7.2, IBM AIX 7.3, and IBM PowerVM VIOS 4.1 NIM. The provided information does not state whether any default configuration is affected.
What is the potential impact of successful exploitation?
A successful attacker could execute arbitrary operating-system commands. The supplied severity vector indicates high confidentiality, integrity, and availability impact, with scope changed.