The vulnerability stems from improper certificate validation that allows a remote attacker to trigger arbitrary code execution on affected IBM AIX and PowerVM VIOS systems. Because certificate verification is meant to guarantee authenticity, a flaw permits forging or manipulating certificates or connections, effectively bypassing security controls. This flaw is identified as CWE-295.

Affected products include IBM AIX versions 7.2 and 7.3, specifically Service Pack/TL combinations SP13 (AIX 7.2 TL05), SP5 (AIX 7.3 TL02), SP3 (AIX 7.3 TL03), and SP2 (AIX 7.3 TL04). For IBM PowerVM VIOS 4.1, the vulnerability is present across Fix Pack levels 4.1.0 4.1.0.50, 4.1.1 4.1.1.30, and 4.1.2 4.1.2.20. These patches are cumulative and address previously reported security issues.

The CVSS score of 7.7 conveys a high severity risk, and while an EPSS score is not available, the flaw can be exploited remotely without any local privileges, making it attractive for attackers. The vulnerability is not yet listed in CISA’s KEV catalog, but the lack of this designation does not diminish potential impact. Because certificate validation is performed by services exposed to external networks, the attack vector is assumed to be remote. Exploitation would likely involve presenting a forged certificate or inducing a service to trust a malicious credential, allowing code execution.