IBM disclosed a CVSS 9.9 OS command injection flaw in the NIM component of AIX 7.2/7.3 and PowerVM VIOS 4.1 that lets a remote authenticated attacker run arbitrary commands.
What Is It
CVE-2026-15068 is an improper neutralization of special elements used in an OS command (CWE-78) affecting the NIM component in IBM AIX and IBM PowerVM VIOS. A remote attacker who is already authenticated can inject crafted input that the system passes into an OS command, resulting in arbitrary command execution.
The CVSS 3.1 base score is 9.9 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The record was published by IBM PSIRT on 2026-08-19 and is currently in NVD status "Received."
Why It Matters
The vector breaks down badly for defenders: network reachable, low attack complexity, no user interaction, and only low privileges required. Scope is Changed, meaning the impact escapes the vulnerable component's security boundary; which is why the score lands at 9.9 rather than 8.8. Confidentiality, integrity, and availability impacts are all rated High.
NIM (Network Installation Management) is administrative infrastructure, so a compromise here plausibly extends to the systems it manages, though neither IBM's bulletin nor the NVD record describes the downstream reach in detail. The Changed scope and low privilege requirement suggest that an account with minimal privileges on a reachable NIM interface may be enough to begin an attack; the specific privilege level and interface exposure required have not been published.
The CISA KEV catalog does not list CVE-2026-15068 as of 2026-08-19, so active exploitation is not confirmed at this time.
What's Vulnerable
Per IBM's affected-product data:
- IBM AIX: 7.2 (incl. 7.2.0) and 7.3 (incl. 7.3.0)
- IBM PowerVM VIOS: 4.1 (incl. 4.1.0)
The affected functionality is the NIM component in these releases.
Patch Status
IBM has published a support bulletin for this issue at node 7283858. The NVD record does not specify fixed version numbers or a required-action deadline; consult the IBM advisory directly for the applicable fix or interim fix (iFix) packages for your release level. No CISA KEV remediation due date applies, as the CVE is not listed in the KEV catalog as of 2026-08-19.
Sources
- IBM Support; Security Bulletin: https://www.ibm.com/support/pages/node/7283858
- NVD, CVE-2026-15068: https://nvd.nist.gov/vuln/detail/CVE-2026-15068
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog