CVE-2025-36251 is a Critical flaw, CVSS 9.6, in the nimsh service SSL/TLS implementation on IBM AIX 7.2 and 7.3 and VIOS 3.1 and 4.1. A remote attacker could run arbitrary commands. IBM ships interim fixes per technology level and asks you to configure NIM in SSL/TLS secure mode.
What's affected
The IBM bulletin lists AIX 7.2, AIX 7.3, VIOS 3.1 and VIOS 4.1 as affected. The vulnerable code sits in the NIM (Network Installation Manager) filesets, and IBM gives the affected ranges per fileset.
bos.sysmgt.nim.client,bos.sysmgt.nim.masterandbos.sysmgt.sysbrat 7.2.5.0 up to 7.2.5.204 (the master fileset goes to 7.2.5.205)- the same three filesets at 7.3.1.0 through 7.3.1.3, 7.3.2.0 through 7.3.2.3 and 7.3.3.0 through 7.3.3.1
IBM assigns four APARs: IJ55968 (AIX 7.2.5 and VIOS 3.1.4), IJ56230 (AIX 7.3.1), IJ56113 (AIX 7.3.2 and VIOS 4.1.0) and IJ55897 (AIX 7.3.3 and VIOS 4.1.1). Fixes ship as interim fixes dated 251112, one set for NIM clients and one for the NIM server (master). The fixes are cumulative and cover earlier NIM bulletins.
IBM says this CVE addresses additional attack vectors for CVE-2024-56347, fixed in an earlier bulletin.
How to check if you're exposed
IBM points to lslpp to see whether the affected filesets are installed and at which level:
lslpp -L | grep -i bos.sysmgt.nim
Compare the level you see with the ranges above. Then match your AIX technology level or VIOS level against the APAR table in the bulletin, because the interim fix name depends on that level. A host that has the NIM master or client filesets in the vulnerable range is in scope even if you rarely use NIM, so include systems that were built from a NIM server long ago.
What to do now
- Read the IBM bulletin and identify every AIX and VIOS host with the NIM filesets in the affected range, including the NIM master and each client.
- Download the fix package from the IBM location named in the bulletin and verify the signatures as IBM describes. The tar file includes a README for enabling the fix.
- Apply the interim fix that matches your level, using the NIM client fix on clients and the NIM server fix on the master.
- IBM states that addressing these issues requires configuring NIM in SSL/TLS secure mode with
nimconfig -cas well as applying the fixes. Do both. - Until you are patched, limit network access to the NIM services to the management hosts that need them.
Why it matters
The affected component is the nimsh service, the NIM client side shell. IBM describes improper process controls in its SSL/TLS implementations, which is the CWE-114 (Process Control) class.
The vector is network, low complexity, no privileges, but user interaction required, with a changed scope and high confidentiality and integrity impact. The user interaction element is why the score is 9.6 and not 10.0. IBM does not spell out what that interaction is in the bulletin text, so read the advisory before judging how hard the flaw is to trigger in your environment.
Neither the record nor the bulletin says this CVE is exploited. Still, it sits beside CVE-2025-36250 in the same bulletin, and the fix path is the same, so patch both together.
Quick check
Does the fix cover CVE-2025-36250 too?
The same IBM bulletin and the same interim fix set cover CVE-2025-36236, CVE-2025-36250 and CVE-2025-36251. Apply them together.
Is user interaction needed?
The CVSS vector says yes. The bulletin does not detail the interaction, so check the IBM advisory directly.
Sources
Last reviewed: 18 October 2026.
