CVE-2026-15061
Received Received - Intake

Path Traversal in IBM AIX and PowerVM VIOS

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: IBM Corporation

Description
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 's nimesis registration service could allow a remote attacker to overwrite files due to path traversal.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-15061
EUVD
EUVD-2026-62423

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
ibm aix 7.2
ibm aix 7.3
ibm powervm_vios 4.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1's nimesis registration service is vulnerable to path traversal. This allows a remote attacker to overwrite files by exploiting improper path validation in the service.

Detection Guidance

Detecting this vulnerability requires checking for the presence of the nimesis registration service on IBM AIX 7.2/7.3 or PowerVM VIOS 4.1. Use commands like 'ps -ef | grep nimesis' to verify if the service is running. Inspect network traffic for unusual file write requests targeting sensitive directories.

Impact Analysis

An attacker could overwrite critical system files, leading to unauthorized modifications, service disruptions, or potential system compromise. This may result in data loss, unauthorized access, or denial of service.

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, violating data integrity and confidentiality requirements in GDPR and HIPAA. Non-compliance risks include fines, legal penalties, and reputational damage.

Mitigation Strategies

Apply IBM's official patches or updates for IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1. Disable the nimesis registration service if not required. Monitor IBM's security advisories for additional mitigation guidance.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15061. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart