CVE-2026-15065: CWE-312 Cleartext Storage of Sensitive Information in IBM AIX

This vulnerability involves the exposure of intermediate certificate authority private keys in a publicly accessible update file for IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1 NIM. The exposure of these keys constitutes cleartext storage of sensitive information (CWE-312), which can enable a remote attacker to bypass security restrictions. The CVSS v3.1 base score is 9.1, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impact.

The exposure of intermediate CA private keys can allow a remote attacker to bypass security restrictions, potentially leading to unauthorized access or impersonation within the affected systems. The confidentiality and integrity of the system are highly impacted, but availability is not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a fix is available, organizations should monitor IBM advisories for updates and consider restricting access to update files or verifying their integrity.