CVE-2025-36096

Published Nov 13, 2025

Last updated 3 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-36096 affects IBM AIX versions 7.2 and 7.3, as well as IBM VIOS versions 3.1, and 4.1. The vulnerability stems from the insecure storage of NIM private keys used in NIM environments. This insecure storage makes the systems susceptible to unauthorized access via man-in-the-middle attacks. Successful exploitation of CVE-2025-36096 could lead to unauthorized data access, potentially compromising data privacy, system reliability, and trust. It can also disrupt system operations, potentially causing a complete denial of service.

Description: IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 stores NIM private keys used in NIM environments in an insecure way which is susceptible to unauthorized access by an attacker using man in the middle techniques.
Source: psirt@us.ibm.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Primary
Base score: 9
Impact score: 6
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

psirt@us.ibm.com: CWE-522

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 10

References