IBM AIX 7.2, AIX 7.3, and IBM PowerVM VIOS 4.1 contain a weakness that allows a local user to obtain root privileges because RBAC authentication roles are not properly enforced. The vulnerability is classified as CWE‑269, Improper Privilege Management, and can enable an attacker to compromise the affected system, alter data, or execute arbitrary code with elevated permissions.

The flaw impacts IBM AIX 7.2 and 7.3 (up through the latest service packs supplied in the advisory) and IBM PowerVM VIOS 4.1.0, 4.1.1, and 4.1.2. The recommended remedial levels are AIX 7.3 TL04 SP2, TL03 SP3, TL02 SP5, 7.2 TL05 SP13, and VIOS Fix Packs 4.1.2.20, 4.1.1.30, and 4.1.0.50, which include cumulative fixes for all prior AIX/VIOS security issues.

With a CVSS score of 7.8 and no EPSS data available, the vulnerability poses a moderate to high risk for environments where a local attacker might gain foothold. It is not listed in the CISA KEV catalog. Most likely, exploitation requires local access or execution privileges on the target system. After applying the Service Pack or Fix Pack, an LPAR reboot is required unless Live Update is used on AIX. For VIOS, additional steps are needed to migrate to Postgres15 following IBM guidance.