CVE-2025-36236: IBM Aix

Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days.

IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request to write arbitrary files on the system.

Affected products

• IBM Aix: version 7.2 only; version 7.3 only
• IBM Vios: version 3.1.0 only; version 4.1.0 only

Published 2025-11-13. Last modified 2026-06-17.