Critical IBM AIX RCE (CVE-2025-36250, CVSS 10.0) Flaw Exposes NIM Private Keys and Risks Directory Traversal

IBM has released a security bulletin detailing several high-severity flaws in AIX 7.2, AIX 7.3, and VIOS 3.1/4.1, including a remote code execution flaw in the NIM server component (CVE-2025-36250, CVSS 10.0) that could let a remote attacker execute arbitrary commands. The bulletin also describes exposure of NIM private keys (CVE-2025-36096, CVSS 9.0) and a directory traversal weakness (CVE-2025-36236, CVSS 8.2), alongside a separate remote command execution via nimsh (CVE-2025-36251, CVSS 9.6).

IBM notes these vulnerabilities are exploitable only if the attacker can establish network connectivity to the affected host, making network exposure a significant risk factor. In the most severe issue, the NIM server flaw could enable an attacker to write arbitrary files or execute commands due to improper process controls, with the overall advisory naming four critical issues, three of which carry CVSS 8.2 or higher and one at the maximum CVSS 10.0. According to bulletin details, affected NIM filesets span multiple TLs and SPs, and IBM has released APARs and fix packages for both AIX and VIOS.