CVE-2026-15061: IBM VIOS Path Traversal Vulnerability

CVE-2026-15061 Overview

CVE-2026-15061 is a path traversal vulnerability [CWE-22] in the nimesis registration service used by IBM AIX and IBM PowerVM Virtual I/O Server (VIOS). The flaw affects IBM AIX 7.2, IBM AIX 7.3, and IBM PowerVM VIOS 4.1. A remote, unauthenticated attacker can send crafted input to the registration service and overwrite files on the target system. Successful exploitation compromises file integrity and can disrupt system availability. IBM published a security advisory addressing the issue.

Critical Impact
Unauthenticated remote attackers can overwrite arbitrary files on affected AIX and VIOS systems, enabling integrity compromise and potential service disruption.

Affected Products

IBM AIX 7.2
IBM AIX 7.3
IBM PowerVM VIOS 4.1

Discovery Timeline

2026-08-19 - CVE-2026-15061 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-15061

Vulnerability Analysis

The vulnerability resides in the nimesis registration service, a component of the Network Installation Management (NIM) subsystem on IBM AIX and PowerVM VIOS. The service accepts registration requests over the network and processes file path parameters supplied by clients. Insufficient validation of these path parameters allows an attacker to include directory traversal sequences that escape the intended working directory. As a result, the service writes attacker-controlled data to arbitrary filesystem locations reachable by the service account.

The attack requires no authentication and no user interaction. Because nimesis typically runs with elevated privileges on AIX and VIOS management hosts, an attacker can overwrite configuration files, scripts, or binaries used by administrative processes. This positions the flaw as a precursor to broader system compromise, even though direct code execution is not explicitly documented in the advisory.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The nimesis service does not canonicalize or reject path components such as ../ before opening target files for writing. Traversal sequences from remote clients therefore reach the underlying filesystem operations unchanged.

Attack Vector

The attack vector is network-based against the port exposed by the nimesis registration listener on NIM masters, clients, and VIOS partitions. An attacker crafts a registration request containing a filename with traversal sequences and arbitrary content. The service resolves the path outside the intended directory and writes the supplied bytes, overwriting the target file.

No verified public exploit code is available for CVE-2026-15061. Refer to the IBM Security Advisory for the authoritative technical description.

Detection Methods for CVE-2026-15061

Indicators of Compromise

Unexpected modification timestamps on system files under /etc, /usr/lpp/bootinst, /var/adm, or NIM working directories on AIX and VIOS hosts.
Inbound network connections to the nimesis service port from hosts outside the trusted NIM management network.
Entries in nimesis and NIM logs containing traversal sequences such as ../ or absolute paths in registration parameters.
New or modified cron entries, inittab records, or shell profiles on AIX or VIOS partitions that were not deployed through change management.

Detection Strategies

Enable and centralize logging from the nimesis daemon and correlate registration events with the source IP address of each request.
Deploy file integrity monitoring on AIX and VIOS system directories to alert on writes performed by the nimesis service account outside its expected paths.
Inspect network traffic to NIM-related ports for registration payloads containing path traversal patterns.

Monitoring Recommendations

Alert on any process spawned by nimesis that writes to directories outside the NIM database and spool paths.
Track outbound connections from AIX and VIOS hosts following inbound registration requests to identify follow-on activity.
Review authentication and privileged command logs on affected hosts for unexpected administrative actions after suspected exploitation.

How to Mitigate CVE-2026-15061

Immediate Actions Required

Apply the fixes published in the IBM Security Advisory to all AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1 systems.
Restrict network access to the nimesis registration service so that only authorized NIM masters and clients can reach it.
Audit AIX and VIOS hosts for unexpected file modifications performed by the nimesis service account prior to patching.

Patch Information

IBM has released iFixes and service packs for AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1. Download the patches and follow the installation instructions provided in the IBM Security Advisory. Verify fix levels using oslevel -s on AIX and ioslevel on VIOS after installation.

Workarounds

Block inbound traffic to the nimesis service at the network perimeter and on host firewalls from untrusted segments until patches are applied.
Disable the NIM registration service on hosts that do not require it, using stopsrc -s nimesis and removing it from the SRC configuration.
Place NIM masters and VIOS management interfaces on isolated management VLANs with strict access control lists.

bash

# Verify AIX fix level and stop the nimesis service where not required
oslevel -s
lssrc -s nimesis
stopsrc -s nimesis