CVE-2023-50326 is a High severity (CVSS 7.5) flaw in IBM PowerSC versions 1.3, 2.0 and 2.1. An inadequate account lockout setting could let a remote attacker brute force account credentials. IBM recommends updating to PowerSC 2.2 and lists no workaround.
What's affected
Product: IBM PowerSC, versions 1.3, 2.0 and 2.1. Affected filesets: powerscStd.uiServer, powerscStd.uiAgent and powerscMFA.server, from level 1.3.0.4 through 2.1.0.6. Fixed: update to PowerSC 2.2, available on Fix Central. IBM's bulletin lists no workarounds or mitigations. NVD published the record on 2 February 2024.
Severity: NVD scores it 7.5 High with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, and IBM's bulletin also gives 7.5, so the sources agree.
The bulletin covers several other PowerSC and PowerSC MFA vulnerabilities, including weak cryptography, cross origin resource sharing, HTML injection and insecure HTTP methods, so the upgrade closes more than this single item.
How to check if you're exposed
PowerSC runs on AIX, and IBM's bulletin gives a command to see whether the affected filesets are installed.
lslpp -l | grep powerscStd
lslpp -l | grep powerscMFA
If you see the filesets powerscStd.uiServer, powerscStd.uiAgent or powerscMFA.server at levels from 1.3.0.4 to 2.1.0.6, you are in the affected range. Run it on every LPAR that hosts the PowerSC server, agents or the MFA server.
Then check the lockout settings in the product, and see whether the web interface or MFA service is reachable from beyond the management network.
What to do now
- Plan the update to PowerSC 2.2, which IBM names as the remediation, and get it from Fix Central.
- Until then, restrict network access to the PowerSC web interface and MFA server to the management network.
- Watch authentication logs for repeated failed logins against PowerSC accounts, which is what a brute force attempt looks like.
- Use strong, unique passwords on PowerSC accounts, and review which accounts exist.
- Record the PowerSC version and fileset levels in your inventory.
Why it matters
The weakness is CWE-307, improper restriction of excessive authentication attempts. When a system does not lock an account, or slow down guesses, after repeated failures, an attacker can try passwords as fast as the network allows. IBM describes the setting as inadequate and the outcome as the ability to brute force account credentials.
The vector shows no privileges and no user interaction, so any remote party who can reach the login is a candidate. The confidentiality impact is high because a guessed account can open the product that is meant to protect your AIX estate. A security management console is a high value target for exactly that reason.
KEV is false and the bulletin does not claim exploitation. Brute force needs a weak password to succeed, so strong credentials and network restriction reduce the risk until you can upgrade. For the open source side, the free gold.safeguard.sh/scan scan helps, and the Gold directory lists this CVE.
Quick check
How do I see whether I run an affected PowerSC?
IBM suggests running lslpp against the PowerSC filesets, for example lslpp -l piped to grep powerscStd. Levels 1.3.0.4 through 2.1.0.6 are in range.
Is there a workaround?
IBM lists none. Update to PowerSC 2.2, and limit network access to the interface meanwhile.
Sources
Last reviewed: 19 October 2026.
