Vulnerability Spotlight: Vulnerabilities in IBM AIX could lead to command injection with elevated privileges

Summary: Cisco Talos researcher Tim Brown discovered two vulnerabilities in IBM's AIX Unix platform: TALOS-2023-1690 (CVE-2023-26286) in the errlog() syscall, where a crafted non-privileged syscall lets the kernel write attacker data to the privileged /dev/error device that errdaemon then misprocesses as root, and TALOS-2023-1691 (CVE-2023-28528) in the invscout setUID binary, where a crafted command-line argument allows arbitrary command injection. Talos confirmed AIX version 7.2 could be exploited and worked with IBM to release an update, with Snort rules 61154 and 61155 detecting attempts against TALOS-2023-1690.
Key Takeaway: The errlog() flaw turns an unprivileged syscall into root-level command execution through a privileged daemon, so any local user on an affected AIX 7.2 system is a potential path to full control of the host.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-26286 CVE-2023-28528
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026