CVE-2025-36250 is a Critical flaw, scored CVSS 10.0, in the nimesis NIM service on IBM AIX 7.2 and 7.3 and VIOS 3.1 and 4.1. A remote, unauthenticated attacker could run arbitrary commands. IBM provides interim fixes per level and requires NIM to be configured in SSL/TLS secure mode.
What's affected
The IBM bulletin lists AIX 7.2, AIX 7.3, VIOS 3.1 and VIOS 4.1 as affected. The vulnerable code sits in the NIM (Network Installation Manager) filesets, and IBM gives the affected ranges per fileset.
bos.sysmgt.nim.client,bos.sysmgt.nim.masterandbos.sysmgt.sysbrat 7.2.5.0 up to 7.2.5.204 (the master fileset goes to 7.2.5.205)- the same three filesets at 7.3.1.0 through 7.3.1.3, 7.3.2.0 through 7.3.2.3 and 7.3.3.0 through 7.3.3.1
IBM assigns four APARs: IJ55968 (AIX 7.2.5 and VIOS 3.1.4), IJ56230 (AIX 7.3.1), IJ56113 (AIX 7.3.2 and VIOS 4.1.0) and IJ55897 (AIX 7.3.3 and VIOS 4.1.1). Fixes ship as interim fixes dated 251112, one set for NIM clients and one for the NIM server (master). The fixes are cumulative and cover earlier NIM bulletins.
IBM describes this CVE as covering additional attack vectors for CVE-2024-56346, which was fixed earlier. If you applied the earlier NIM fixes, you still need this newer cumulative fix.
How to check if you're exposed
IBM points to lslpp to see whether the affected filesets are installed and at which level:
lslpp -L | grep -i bos.sysmgt.nim
Compare the level you see with the ranges above. Then match your AIX technology level or VIOS level against the APAR table in the bulletin, because the interim fix name depends on that level. A host that has the NIM master or client filesets in the vulnerable range is in scope even if you rarely use NIM, so include systems that were built from a NIM server long ago.
What to do now
- Read the IBM bulletin and identify every AIX and VIOS host with the NIM filesets in the affected range, including the NIM master and each client.
- Download the fix package from the IBM location named in the bulletin and verify the signatures as IBM describes. The tar file includes a README for enabling the fix.
- Apply the interim fix that matches your level, using the NIM client fix on clients and the NIM server fix on the master.
- IBM states that addressing these issues requires configuring NIM in SSL/TLS secure mode with
nimconfig -cas well as applying the fixes. Do both. - Until you are patched, limit network access to the NIM services to the management hosts that need them.
Why it matters
IBM attributes the flaw to improper process controls in nimesis. That maps to CWE-114 (Process Control), a weakness where a program lets outside input influence which commands or processes it runs.
The score of 10.0 comes from the vector: network, low complexity, no privileges, no user interaction, a changed scope, and high impact on confidentiality, integrity and availability. The changed scope matters here. A NIM master can reach the machines it installs and manages, so a takeover can spread beyond the one host.
The record does not list this CVE in the CISA catalog, and the bulletin does not report exploitation. A fix for the earlier CVE-2024-56346 did not close every route, which is a reminder to read follow up bulletins and not assume an old patch is complete.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why do I need a new fix if I patched CVE-2024-56346?
IBM says this CVE addresses additional attack vectors for that earlier flaw. The new fixes are cumulative and cover the earlier NIM bulletins.
Which hosts come first?
Start with the NIM master, then NIM clients that are reachable from less trusted networks.
Sources
Last reviewed: 18 October 2026.
