IBM disclosed a critical flaw (CVSS 9.1) in which intermediate certificate authority private keys were exposed inside a publicly available update file for AIX and PowerVM VIOS NIM, allowing remote attackers to bypass security restrictions.
What Is It
CVE-2026-15065 is a cleartext/exposed-secret storage issue (CWE-312) affecting the NIM (Network Installation Management) component of IBM AIX and IBM PowerVM VIOS. According to IBM's advisory, intermediate certificate authority private keys were included in a publicly available update file. With those keys, a remote attacker can bypass security restrictions that depend on the trust chain those certificates anchor.
The CVSS 3.1 vector, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, describes the worst-case profile short of an availability impact: network-reachable, low complexity, no privileges, and no user interaction required, with high confidentiality and integrity impact. That combination yields a base score of 9.1 (CRITICAL), with a maximum exploitability subscore of 3.9.
Why It Matters
Leaked intermediate CA private keys are not a bug that gets contained by patching a single service. Anyone who obtained the update file holds material that can be used to produce trusted certificates, which undermines authentication and integrity guarantees rather than just crashing a process. The "no privileges, no user interaction, network vector" scoring reflects that the attacker needs nothing from the target environment beyond reachability.
The supplied source material does not include a CISA KEV entry for this CVE, so there is no confirmation of active exploitation and no KEV-mandated remediation deadline at this time.
What's Vulnerable
- IBM AIX 7.2
- IBM AIX 7.3
- IBM PowerVM VIOS 4.1
The affected functionality is NIM on the above versions.
Patch Status
IBM's PSIRT is the assigning source ([email protected]), and the CVE record was published 2026-08-19 with a status of "Received," meaning NVD analysis is still pending. The only remediation reference supplied is IBM's support advisory at node 7283858; administrators of affected AIX and VIOS systems should consult it directly for fix levels and any certificate-replacement steps. No specific required-action text or deadline is present in the supplied data.
Sources
- IBM Support Advisory; https://www.ibm.com/support/pages/node/7283858
- NVD, CVE-2026-15065, https://nvd.nist.gov/vuln/detail/CVE-2026-15065