On 13 November 2025, IBM published a new security bulletin highlighting four critical vulnerabilities in AIX (also known as IBM VIOS). These issues impact the NIM (Network Installation Manager) infrastructure, which provides unattended operating system installation, configuration, updates and third-party software. As such, NIM is often installed on a highly privileged system within large enterprise infrastructure environments.
The vulnerabilities published include:
- CVE‑2025‑36250: Remote, unauthenticated command execution in the NIM master (nimesis) service.
- CVE‑2025‑36251: Remote command execution in the nimsh service (SSL/TLS implementation) via improper process controls.
- CVE‑2025‑36236: Directory traversal and arbitrary file-write via specially crafted URL requests in the NIM server.
- CVE‑2025‑36096: Insecure storage of NIM private keys, making them accessible via “man-in-the-middle” style attacks.
These vulnerabilities present a chainable exploit path, where an attacker might leverage path-traversal (CVE-2025-36236) to drop malicious payloads, remotely execute them (CVE-2025-36250/CVE-2025-36251), and then utilise the exposed private keys (CVE-2025-36096) to persist, pivot or impersonate internal services. In environments where NIM infrastructure is deployed, the risk is very high.
All actively supported versions (7.2 and 7.3) are affected. IBM provide instructions to check filesets to confirm vulnerable versions, and have provided fix packages in the official advisories.
What impact may this have on businesses using AIX
AIX remains widely deployed in enterprise and mission-critical environments, such as financial systems, large scale back-end infrastructure, legacy services, and high-availability environments.
Because of its role, we have observed that patch cycles for AIX can be slower than for typical Linux/Windows distributions. Organisations tend to prioritise stability for critical systems (often running legacy applications), meaning vulnerabilities can be exposed for longer or entirely overlooked.
The nature of an AIX server running NIM means that it likely has connectivity and elevated privileges to access a large number of AIX hosts, therefore a compromised NIM server may risk widespread exploitation.
Next steps to evaluate and secure AIX installations
Inventory: Check asset registers and other data sources to confirm all installations of AIX.
NIM: On each AIX/VIOS host, run;
ps -ef | grep nimto verify whether NIM master/client services are running.
Filesets: On each AIX/VIOS host, the reported vulnerabilities exist within the following filesets;
| Fileset | Lower Level | Upper Level |
| bos.sysmgt.nim.client | 7.2.5.0 | 7.2.5.204 |
| bos.sysmgt.nim.master | 7.2.5.0 | 7.2.5.205 |
| bos.sysmgt.sysbr | 7.2.5.0 | 7.2.5.204 |
| bos.sysmgt.nim.client | 7.3.1.0 | 7.3.1.3 |
| bos.sysmgt.nim.master | 7.3.1.0 | 7.3.1.3 |
| bos.sysmgt.sysbr | 7.3.1.0 | 7.3.1.3 |
| bos.sysmgt.nim.client | 7.3.2.0 | 7.3.2.3 |
| bos.sysmgt.nim.master | 7.3.2.0 | 7.3.2.3 |
| bos.sysmgt.sysbr | 7.3.2.0 | 7.3.2.3 |
| bos.sysmgt.nim.client | 7.3.3.0 | 7.3.3.1 |
| bos.sysmgt.nim.master | 7.3.3.0 | 7.3.3.1 |
| bos.sysmgt.sysbr | 7.3.3.0 | 7.3.3.1 |
Check for vulnerable versions using the following command;
lslpp -L | grep -i [fileset]Patch: Follow the IBM bulletin instructions to install fixes.
How can Sentrium help?
Sentrium offer vulnerability assessment and network penetration testing services that can support you in identifying vulnerable AIX systems across your environments. Start your assessment today by getting a fast pentest quote, or get in touch with our team to find out more about our penetration testing services.
