CVE-2025-36096 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

🏢 **Affected Products**: • **IBM AIX**: Versions 7.2 & 7.3 • **IBM VIOS**: Versions 3.1 & 4.1 ⚠️ These systems manage Power architecture and I/O resource sharing.

Q: Is there a public Exp? (PoC/Wild Exploitation)

📦 **Public Exploit**: **No**. • The `pocs` list is empty. • No public PoC or wild exploitation detected as of publication (2025-11-13).

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: • Scan for **IBM AIX 7.2/7.3** and **VIOS 3.1/4.1**. • Verify **NIM configuration** security settings. • Check for unencrypted or poorly protected private keys in NIM storage directories.

Q: Is it fixed officially? (Patch/Mitigation)

✅ **Official Fix**: **Yes**. • IBM has released a vendor advisory. • **Action**: Apply the official patch provided by IBM to secure the NIM private key storage.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. • CVSS Score: **9.1** (High). • Impact: Full system compromise via MitM. • **Priority**: Patch immediately upon availability. Do not ignore this vulnerability.

Updated May 06, 2026 CVSS 9.0 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: IBM AIX & VIOS have a critical flaw in **NIM private key storage**.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-522** (Insufficiently Protected Credentials).…

Read full answer (login)

Q3Who is affected? (Versions/Components)

🏢 **Affected Products**: <br>• **IBM AIX**: Versions 7.2 & 7.3 <br>• **IBM VIOS**: Versions 3.1 & 4.1 <br>⚠️ These systems manage Power architecture and I/O resource sharing.

Q4What can hackers do? (Privileges/Data)

💻 **Attacker Capabilities**: <br>• **Privileges**: High impact on System (S:C). <br>• **Data**: Full Confidentiality (C:H) & Integrity (I:H) loss.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

🔒 **Exploitation Threshold**: <br>• **Access**: No Privileges required (PR:N). <br>• **Complexity**: High (AC:H). <br>• **User Interaction**: None (UI:N).…

Read full answer (login)

Q6Is there a public Exp? (PoC/Wild Exploitation)

📦 **Public Exploit**: **No**. <br>• The `pocs` list is empty. <br>• No public PoC or wild exploitation detected as of publication (2025-11-13).

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: <br>• Scan for **IBM AIX 7.2/7.3** and **VIOS 3.1/4.1**. <br>• Verify **NIM configuration** security settings. <br>• Check for unencrypted or poorly protected private keys in NIM storage directories.

Q8Is it fixed officially? (Patch/Mitigation)

✅ **Official Fix**: **Yes**. <br>• IBM has released a vendor advisory. <br>• **Action**: Apply the official patch provided by IBM to secure the NIM private key storage.

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: <br>• Restrict network access to NIM services. <br>• Implement strict **network segmentation** to prevent MitM opportunities.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. <br>• CVSS Score: **9.1** (High). <br>• Impact: Full system compromise via MitM. <br>• **Priority**: Patch immediately upon availability. Do not ignore this vulnerability.

Continue exploring

Vulnerability detail Full AI analysis (login) IBM CWE-522