CVE-2026-19449

Received Received - Intake

cmdnim Command Injection in IBM AIX and PowerVM VIOS

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: IBM Corporation

Description

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a vulnerability in cmdnim that may allow an unprivileged local user to executes the payload as root.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-19449

EUVD

EUVD-2026-63753

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	aix	7.2
ibm	aix	7.3
ibm	powervm_vios	4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a flaw in the cmdnim utility. An unprivileged local attacker could exploit this to execute arbitrary commands with root privileges.

Detection Guidance

This vulnerability involves IBM AIX and PowerVM VIOS systems where cmdnim may allow local privilege escalation. Detection requires checking for cmdnim execution patterns or unauthorized root access attempts. Review system logs for cmdnim-related commands and monitor for unexpected privilege changes. No specific commands are provided in the CVE details.

Impact Analysis

If exploited, this vulnerability allows an attacker to gain full control of the affected system, potentially leading to data theft, system compromise, or unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating compliance requirements such as GDPR or HIPAA, which mandate strict data protection and access controls.

Mitigation Strategies

Apply the latest IBM AIX or PowerVM VIOS patches from IBM immediately. Restrict local user access to cmdnim commands until patched. Monitor for unusual root-level command executions.

Hi! I’m here to help you understand CVE-2026-19449. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70