CVE-2026-15065: IBM VIOS Information Disclosure Flaw

CVE-2026-15065 Overview

CVE-2026-15065 affects IBM AIX 7.2, IBM AIX 7.3, and IBM PowerVM VIOS 4.1 Network Installation Manager (NIM). The vulnerability stems from intermediate certificate authority (CA) private keys being included in a publicly available update file. A remote unauthenticated attacker can retrieve these private keys and use them to bypass security restrictions that depend on the compromised CA trust chain. The weakness is classified as cleartext storage of sensitive information [CWE-312].

Critical Impact
Exposure of intermediate CA private keys allows attackers to forge trusted certificates, impersonate IBM AIX and VIOS NIM services, and bypass certificate-based authentication across affected environments.

Affected Products

IBM AIX 7.2
IBM AIX 7.3
IBM PowerVM VIOS 4.1 (NIM component)

Discovery Timeline

2026-08-19 - CVE-2026-15065 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-15065

Vulnerability Analysis

The flaw resides in the Network Installation Manager (NIM) component shipped with IBM AIX and PowerVM VIOS. NIM manages remote software installation and update delivery across AIX systems. IBM published an update file that contained intermediate CA private keys used to sign or validate NIM communication material.

Because the update file is publicly downloadable, any remote attacker can obtain the private keys without authentication or user interaction. Possession of the intermediate CA private key enables an attacker to issue certificates that clients trust as if signed by IBM. This undermines the integrity and confidentiality guarantees of any NIM operation that relies on the affected certificate chain.

Root Cause

The root cause is the inclusion of secret cryptographic material in a distribution artifact. Private keys belonging to an intermediate CA were packaged inside a publicly available update file rather than being retained in a controlled signing environment. This is a textbook instance of cleartext storage of sensitive information [CWE-312] combined with a key management failure.

Attack Vector

The attack vector is fully remote and requires no privileges or user interaction. An attacker downloads the affected update file from IBM distribution channels, extracts the intermediate CA private keys, and generates attacker-controlled certificates signed by that intermediate CA. The attacker then intercepts or impersonates NIM services, injects trusted content, or bypasses authentication mechanisms that rely on the compromised trust chain.

Because exploitation depends on cryptographic material rather than a memory corruption primitive, no proof-of-concept binary is required. See the IBM Support Page for the vendor advisory and remediation guidance.

Detection Methods for CVE-2026-15065

Indicators of Compromise

Unexpected certificates presented by NIM servers or clients that chain to the exposed intermediate CA
NIM install or update operations initiated from unrecognized source hosts on the management network
TLS handshakes on NIM-related ports where the peer certificate serial number or issuer does not match the known IBM production chain

Detection Strategies

Enumerate all certificates in AIX and VIOS trust stores and compare issuer fingerprints against IBM's revocation guidance in the vendor advisory
Inspect network captures of NIM traffic for certificate chains that include the exposed intermediate CA
Correlate NIM client provisioning events with authorized change tickets to identify unauthorized installations

Monitoring Recommendations

Alert on new or modified files under NIM working directories such as /export/nim and /var/adm/ras/nim
Log and review outbound connections from AIX and VIOS hosts to any non-approved NIM master
Continuously monitor certificate transparency and internal PKI events for certificates issued by the compromised intermediate CA

How to Mitigate CVE-2026-15065

Immediate Actions Required

Apply the fix packages referenced in the IBM Support Page for AIX 7.2, AIX 7.3, and VIOS 4.1 as soon as available
Revoke and distrust the exposed intermediate CA in all AIX, VIOS, and dependent client trust stores
Rotate any certificates issued under the compromised intermediate CA and reissue them from a clean chain

Patch Information

IBM has published remediation guidance on the IBM Support Page. Administrators should follow the vendor-provided iFix or service pack instructions for their specific AIX and VIOS levels. Patching alone is not sufficient. Any certificate signed by the exposed intermediate must also be revoked and reissued.

Workarounds

Restrict NIM master and client communication to isolated management VLANs with strict access control lists
Enforce out-of-band verification of NIM update sources until the compromised CA is fully removed from trust stores
Disable automatic trust of the affected intermediate CA on all endpoints that consume AIX or VIOS update material

bash

# Configuration example: list and inspect certificates in the AIX trust store
# Adjust paths to match your environment before executing
for cert in /var/ssl/certs/*.pem; do
  echo "=== $cert ==="
  openssl x509 -in "$cert" -noout -issuer -subject -fingerprint -sha256
done