CVE-2026-15078: Vulnerabilities in IBM AIX and PowerVM VIOS
AIX NIM could allow a remote attacker to gain unauthorized access to AIX systems due to improper validation of TLS certificates.
Other sources
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to gain unauthorized access to AIX systems due to improper validation of TLS certificates.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM PowerVM VIOS 4.1.0 (NIM)to a version that resolves this vulnerability.Fixed in 4.1.0.50Patch IJ5956508 - Upgrade
Upgrade
IBM PowerVM VIOS 4.1.1 (NIM)to a version that resolves this vulnerability.Fixed in 4.1.1.30Patch IJ5956408 - Upgrade
Upgrade
IBM PowerVM VIOS 4.1.2 (NIM)to a version that resolves this vulnerability.Fixed in 4.1.2.20Patch IJ5956308 - Compensating control
If using nimsh secure to apply the patches, take the special steps mentioned in the IBM instructions (protocol between master and client is updated to be more secure).
- Operational
For the SP/FP remediations, perform an LPAR reboot to complete the SP/FP update (AIX/VIOS remediations require an LPAR reboot).
- Operational
If running VIOS 4.1.0 or VIOS 4.1.1, after applying the 4.1.0.50 or 4.1.1.30 FPs respectively, perform the additional steps required to migrate to the latest Postgres15 (as noted by IBM).
- Operational
On AIX, Live Update can be used to avoid a reboot when applying the SP/FP update.
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects AIX NIM in IBM AIX 7.2 and 7.3, and NIM in IBM PowerVM VIOS 4.1.
What level of access does an attacker need?
The vector is network-based, requires low privileges, and does not require user interaction. The available data attributes the issue to improper TLS certificate validation in NIM.
What is the potential impact?
A remote attacker could gain unauthorized access to AIX systems. The supplied severity vector indicates high confidentiality and integrity impact, with no stated availability impact.