This vulnerability (CVE-2026-15065) concerns IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 NIM, where intermediate certificate authority private keys are stored in cleartext within a publicly accessible update file. This exposure could enable remote attackers to bypass security restrictions by leveraging the compromised keys. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impacts. The vulnerability is classified under CWE-312 (Cleartext Storage of Sensitive Information). As of the published date, no vendor advisory or patch information is available.

The exposure of intermediate certificate authority private keys in cleartext can lead to a remote attacker bypassing security restrictions, potentially compromising the confidentiality and integrity of affected systems. This could allow unauthorized access or manipulation of secure communications or authentication mechanisms relying on these keys. The vulnerability does not impact availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should limit exposure of update files and monitor for suspicious activity related to certificate authority keys. Avoid distributing or using the affected update files in untrusted environments.