Loading story…
IBM has disclosed several critical vulnerabilities affecting AIX 7.2, 7.3, and VIOS 3.1, 4.1 systems, specifically targeting the Network Installation Manager (NIM) services. The vulnerabilities include two arbitrary command execution flaws (CVE-2025-36250 and CVE-2025-36251), a path traversal vulnerability (CVE-2025-36236), and an issue with insufficiently protected credentials (CVE-2025-36096). These flaws allow remote attackers to execute arbitrary commands, traverse directories to write files, and potentially obtain sensitive NIM private keys through man-in-the-middle attacks, all due to improper process controls and insecure storage practices. The vulnerabilities are remotely exploitable if an attacker can establish network connectivity to the affected host, with CVSS scores ranging from 8.2 to 10, indicating high to critical severity.
IBM has released security bulletins and patches to address these vulnerabilities, which also close additional attack vectors related to previously disclosed issues (CVE-2024-56346 and CVE-2024-56347). Organizations running affected versions of AIX and VIOS are strongly advised to apply the recommended fixes immediately to mitigate the risk of remote exploitation, credential theft, and unauthorized file manipulation. The vulnerabilities impact core NIM services, including nimesis and nimsh, and highlight the importance of securing network access to critical infrastructure components.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
IBM published a security bulletin covering CVE-2025-36251 and CVE-2025-36250 (arbitrary command/code execution), CVE-2025-36096 (insufficiently protected credentials), and CVE-2025-36236 (path traversal) affecting AIX 7.2/7.3 and VIOS 3.1/4.1. The bulletin directed customers to apply security updates and harden or restrict exposed NIM/nimsh services.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceibm.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
IBM disclosed that **IBM i NetServer** is affected by **15 vulnerabilities** across versions **7.3, 7.4, 7.5, and 7.6**, with impacts including sensitive information disclosure, denial of service, and unauthorized access to server resources. The bulletin describes multiple weakness classes, including **out-of-bounds read** (`CWE-125`), out-of-bounds write, integer overflow, incomplete bounds checking, improper authentication, heap buffer overflow, and use of uninitialized memory. IBM said the most severe issues reach **CVSS 8.6** and that **no workarounds or mitigations** are available. Among the newly tracked issues, **`CVE-2026-16867`** affects NTLM session negotiation and could let a remote attacker access server resources with the privileges of an authenticated user, while **`CVE-2026-16868`** could allow a remote denial-of-service condition through uninitialized memory during ASN.1 length processing. IBM directed customers to apply fixes delivered in **PTFs `MJ10936` through `MJ10939`** to address the NetServer flaws.
Aug 13, 2026
IBM disclosed a broad set of vulnerabilities affecting **IBM i** versions `7.3` through `7.6`, with the most serious issues enabling remote code execution, privilege escalation, and security bypass. In **Navigator for i**, IBM reported multiple flaws including improper authorization, command injection, XML injection, unsafe reflection, and improper privilege management. The highest-rated Navigator issue, `CVE-2026-17276` (**CVSS 9.6**), could let a remote authenticated attacker escalate privileges through high-authority thread handling, while `CVE-2026-18235` could allow authenticated execution of arbitrary Control Language commands and `CVE-2026-17095` could permit restriction bypass. IBM also tied the bulletin to additional high-severity weaknesses such as `CVE-2026-16904` and `CVE-2026-18098`, which could enable arbitrary command execution or expose sensitive information. Separate IBM i flaws addressed in the same patch cycle include `CVE-2026-16860`, a **CVSS 9.9** uncontrolled search path issue that could lead to remote code execution with low-privileged access, and `CVE-2026-17083`, a **CVSS 9.8** unauthenticated stack-based buffer overflow in the **IBM i Debug Server** that could enable remote code execution. IBM released fixes through PTFs **SJ10887**, **SJ10888**, **SJ10890**, and **SJ10891**, said no workarounds or mitigations were available for the Navigator for i bulletin, and urged customers to apply the updates immediately or move unsupported systems to fixed supported releases. Reporting on the release said there was no known active exploitation at publication, but warned that exposed Debug Server instances and enterprise IBM i systems running payroll, ERP, supply chain, and financial workloads face elevated risk until patched.
Aug 13, 2026
A series of critical and high-severity vulnerabilities have been disclosed affecting a wide range of software products, including workflow automation tools, web applications, network devices, and desktop software. Notable issues include remote code execution (RCE) flaws in *n8n*, *Lilac-Reloaded for Nagios*, *FileZilla Client*, and *AVideo*, as well as privilege escalation vulnerabilities in products like *Versa SASE Client*, *AspEmail*, and *ActFax*. Several vulnerabilities allow unauthenticated attackers to upload arbitrary files, bypass authentication, or exploit weak session management, potentially leading to full system compromise or unauthorized access to sensitive data. Many of these vulnerabilities have public exploits available, increasing the risk of active exploitation in the wild. Vendors have released patches for several of the affected products, and administrators are strongly advised to update to the latest versions or apply recommended mitigations. The vulnerabilities span a variety of attack vectors, including buffer overflows, improper input validation, insecure file upload mechanisms, and misconfigured authentication endpoints. Organizations should prioritize patching systems exposed to the internet and review access controls to limit the impact of potential exploitation. Immediate attention is warranted for products with critical CVSS scores and those with known public exploits.
Jun 29, 2026