CVE-2025-36236 is a High severity (CVSS 8.2) path traversal flaw in the NIM service, nimesis, on IBM AIX 7.2 and 7.3 and IBM VIOS 3.1 and 4.1. A remote attacker with no credentials can write arbitrary files. IBM's fix is an interim fix per technology level, plus NIM running in SSL/TLS secure mode.
What's affected
The IBM bulletin lists AIX 7.2, AIX 7.3, VIOS 3.1 and VIOS 4.1 as affected. The vulnerable code sits in the NIM (Network Installation Manager) filesets, and IBM gives the affected ranges per fileset.
bos.sysmgt.nim.client,bos.sysmgt.nim.masterandbos.sysmgt.sysbrat 7.2.5.0 up to 7.2.5.204 (the master fileset goes to 7.2.5.205)- the same three filesets at 7.3.1.0 through 7.3.1.3, 7.3.2.0 through 7.3.2.3 and 7.3.3.0 through 7.3.3.1
IBM assigns four APARs: IJ55968 (AIX 7.2.5 and VIOS 3.1.4), IJ56230 (AIX 7.3.1), IJ56113 (AIX 7.3.2 and VIOS 4.1.0) and IJ55897 (AIX 7.3.3 and VIOS 4.1.1). Fixes ship as interim fixes dated 251112, one set for NIM clients and one for the NIM server (master). The fixes are cumulative and cover earlier NIM bulletins.
How to check if you're exposed
IBM points to lslpp to see whether the affected filesets are installed and at which level:
lslpp -L | grep -i bos.sysmgt.nim
Compare the level you see with the ranges above. Then match your AIX technology level or VIOS level against the APAR table in the bulletin, because the interim fix name depends on that level. A host that has the NIM master or client filesets in the vulnerable range is in scope even if you rarely use NIM, so include systems that were built from a NIM server long ago.
What to do now
- Read the IBM bulletin and identify every AIX and VIOS host with the NIM filesets in the affected range, including the NIM master and each client.
- Download the fix package from the IBM location named in the bulletin and verify the signatures as IBM describes. The tar file includes a README for enabling the fix.
- Apply the interim fix that matches your level, using the NIM client fix on clients and the NIM server fix on the master.
- IBM states that addressing these issues requires configuring NIM in SSL/TLS secure mode with
nimconfig -cas well as applying the fixes. Do both. - Until you are patched, limit network access to the NIM services to the management hosts that need them.
Why it matters
The NIM server service, nimesis, accepts a URL request from the network. According to IBM, a specially crafted request can traverse directories and write arbitrary files on the system. The weakness class is CWE-22 (Path Traversal), where a path built from outside input is not confined to the directory the program meant to use.
The CVSS vector shows network access, low complexity, no privileges and no user interaction, with high integrity impact and low availability impact. Arbitrary file write on an infrastructure server is serious because the written file can change how the host behaves later. The record does not mark this CVE as exploited in the wild, and the IBM bulletin does not claim it either.
NIM servers tend to be long lived and rarely looked at, which is why a bulletin like this is easy to miss. Treat the NIM master as a high value host, since it holds the installation images and trust relationships for many other machines.
Quick check
Is CVE-2025-36236 exploited in the wild?
The record does not flag it as a CISA Known Exploited Vulnerability, and the IBM bulletin does not say it is exploited. Patch on normal urgency for a network reachable, unauthenticated flaw.
Is installing the interim fix enough?
IBM says the fix also needs NIM configured in SSL/TLS secure mode with the nimconfig command. Follow the README in the fix tar file.
Sources
Last reviewed: 18 October 2026.
