Description

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass security restrictions due to the exposure of intermediate certificate authority private keys in a publicly available update file.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-19T15:16:55.787Z",
  "pubdate": "2026-08-19T15:16:55.787Z",
  "executiveSummary": "A critical security vulnerability has been identified in IBM AIX 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1 NIM (Network Installation Management), which could allow a remote attacker to bypass security restrictions. The vulnerability stems from the inadvertent exposure of intermediate certificate authority (CA) private keys contained within a publicly available update file. This exposure compromises the cryptographic trust chain associated with the affected systems, carrying significant risk implications for enterprise environments relying on secure communications and deployments managed via NIM. An attacker capable of accessing the public update file can extract the sensitive private cryptographic material without requiring specialized authentication or elevated privileges. Consequently, this exposes the infrastructure to potential spoofing, man-in-the-middle (MitM) attacks, and unauthorized trust validation bypasses. Remediation requires applying official vendor patches or updates to replace compromised cryptographic assets and invalidate leaked keys across all managed nodes.",
  "technicalDetails": "The vulnerability resides within the cryptographic key management practices implemented in the distribution channels for IBM AIX 7.2, IBM AIX 7.3, and IBM PowerVM VIOS 4.1 NIM. The root cause of the issue is the inclusion of intermediate certificate authority private keys within a publicly accessible software update file. Because these private keys are shipped openly without proper redaction or access controls, any remote unauthenticated entity can download the update package and extract the sensitive cryptographic material.\nThe attack flow begins with the reconnaissance and acquisition of the publicly available update file associated with the vulnerable NIM components. Once the file is retrieved, an attacker parses its contents to locate and extract the exposed intermediate CA private keys. Possession of these private keys grants the attacker the ability to cryptographically sign fraudulent certificates or impersonate trusted entities within the scope of the affected NIM infrastructure.\nIn terms of exploitation requirements, the vulnerability does not necessitate prior authentication, elevated privileges, or complex local access vectors, as the vulnerable file is exposed remotely via public update distribution mechanisms. The affected component is the cryptographic trust infrastructure utilized by NIM for managing network installations and communications. Post-exploitation impact includes the potential bypass of security restrictions, cryptographic spoofing of software updates or nodes, and compromise of the trust architecture established by the intermediate CA. Mitigation requires the revocation of the compromised intermediate CA certificates, generation of new cryptographic material, and deployment of updated software packages that eliminate the exposed private keys."
}