The vulnerability in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 allows a local attacker to achieve privilege escalation due to an improper authorization control (CWE‑285). An attacker who can execute code or commands on the target system may elevate privileges to root or system level, enabling full compromise of the affected instance. This flaw can be triggered without affecting network exposure, and it is not described as a remote exploit.

IBM AIX versions 7.2 (including all Service Packs through SP13) and 7.3 (Service Packs through SP5, TL04SP2, TL03SP3, TL02SP5) are affected. PowerVM VIOS 4.1 is vulnerable at all Fix Pack levels, with recommended remediation levels of VIOS 4.1.2 (4.1.2.20), 4.1.1 (4.1.1.30) and 4.1.0 (4.1.0.50). The advisory lists specific APAR identifiers for each level, and these patches are cumulative across the lines.

The CVSS base score of 7.1 classifies the issue as high severity, and because the EPSS is not available, the historical exploitation probability is unknown. As the vulnerability requires local access, the attacker must already have some foothold; however, once the flaw is exploited, full system takeover is possible. The advisory explicitly recommends immediate patching and does not list the issue in the CISA KEV catalog, implying no confirmed active exploitation. Operators should treat this as a high‑risk local privilege escalation unless mitigated by the patch.