IBM reports critical flaws in AIX Network Installation Manager
Take action: If you are running AIX operating system, review the advisory in detail and plan a quick update. IBM has reported maximum severity flaw, and even if AIX servers are not that common, there may be exploits. Keep your servers patched.
Learn More
IBM is reporting multiple critical security vulnerabilities affecting its AIX server operating system and Virtual I/O Server (VIOS). The vulnerabilities primarily impact the Network Installation Manager (NIM) infrastructure, a core component used for managing AIX system installations, updates, and configurations across enterprise environments.
Vulnerabilities summary:
- CVE-2025-36250 (CVSS score 10.0): IBM AIX NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to execute arbitrary commands due to improper process controls. This flaw exposes additional attack vectors for a vulnerability that was previously addressed in CVE-2024-56346.
- CVE-2025-36251 (CVSS score 9.6): IBM AIX nimsh service SSL/TLS implementations could allow a remote attacker to execute arbitrary commands due to improper process controls. This flaw exposes additional attack vectors for a vulnerability that was previously addressed in CVE-2024-56347.
- CVE-2025-36096 (CVSS score 9.0): IBM AIX stores NIM private keys used in NIM environments in an insecure mechanism that is susceptible to unauthorized access by an attacker using man-in-the-middle techniques. This allows attackers who can intercept network traffic to obtain private keys that provide authentication to NIM infrastructure components.
- CVE-2025-36236 (CVSS score 8.2): IBM AIX NIM server service (nimesis) could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request to write arbitrary files on the system.
All actively supported AIX versions 7.2 and 7.3, as well as VIOS versions 3.1 and 4.1, are affected by these security flaws.
IBM has released APAR (Authorized Program Analysis Report) numbers to track the fixes for each affected version.
- For AIX 7.2.5, the relevant APAR is IJ55968 (Service Pack 11);
- for AIX 7.3.1, it is IJ56230;
- for AIX 7.3.2, it is IJ56113;
- for AIX 7.3.3, it is IJ55897 (Service Pack 2).
- Corresponding APARs have been assigned for VIOS versions, with IJ55968 for VIOS 3.1.4, IJ56113 for VIOS 4.1.0, and IJ55897 for VIOS 4.1.1 (Fix Pack 4.1.1.20).
First, organizations must configure NIM in SSL/TLS Secure mode using the "nimconfig -c" command to enable encrypted communications between NIM components. Then, administrators must apply the appropriate interim fixes provided by IBM for their specific AIX or VIOS version. The fixes are cumulative and address previously issued AIX/VIOS NIM security bulletins, including prior advisories from earlier in 2024. A detailed README file is provided in the fix package to guide administrators through the process of enabling secure mode and applying the patches correctly.
