CVE-2026-15078: Vulnerabilities in IBM AIX and PowerVM VIOS
AIX NIM could allow a remote attacker to gain unauthorized access to AIX systems due to improper validation of TLS certificates.
Other sources
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to gain unauthorized access to AIX systems due to improper validation of TLS certificates.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.0.50 - Upgrade
Upgrade
IBM PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.1.30Patch key_w_apar4.1.1IJ5956408/14/2026 - Upgrade
Upgrade
IBM PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.2.20Patch key_w_apar4.1.2IJ5956308/14/2026 - Operational
After applying the AIX Service Pack (SP) / VIOS Fix Pack (FP) updates, perform an LPAR reboot to complete the SP/FP update.
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects AIX NIM in IBM AIX 7.2 and 7.3, and NIM in IBM PowerVM VIOS 4.1.
What level of access does an attacker need?
The vector is network-based, requires low privileges, and does not require user interaction. The available data attributes the issue to improper TLS certificate validation in NIM.
What is the potential impact?
A remote attacker could gain unauthorized access to AIX systems. The supplied severity vector indicates high confidentiality and integrity impact, with no stated availability impact.