# IBM AIX nimesis and nimsh services allow arbitrary code execution

Published: 2026-06-09 · Severity: routine · Sectors: government-national, defense, infrastructure
Canonical: https://vorant.io/reports/1817dae2-06cf-56ec-a8b5-3c9355ad9eb8/ibm-aix-nimesis-and-nimsh-services-allow-arbitrary-code-execution

> Two vulnerabilities in IBM AIX NIM services enable arbitrary code execution; no active exploitation reported yet.

Multiple vulnerabilities have been discovered in IBM AIX affecting the nimesis NIM Master service and nimsh SSL/TLS service across versions 7.2 and 7.3. The most severe flaws involve flawed process controls in the nimesis NIM master service (CVE-2024-56346) and improper SSL/TLS protection in the nimsh service (CVE-2024-56347), both enabling arbitrary command execution. Successful exploitation could grant attackers the ability to execute code in the context of the affected system, install programs, modify or delete data, or create new privileged accounts depending on the compromised account's privilege level. IBM has released patches and administrators should apply these immediately following testing. No active exploitation in the wild has been reported as of the advisory date.

## Mentioned in this report

- Vulnerabilities: CVE-2024-56346, CVE-2024-56347

## Detection guidance (public sample)

### AIX NIM Service Spawning Shell With Download or Reverse Shell Tooling

ATT&CK: T1190

nimesis or nimsh daemons spawning a shell or network tooling with download, reverse-shell or bind-shell command lines, consistent with exploitation of CVE-2024-56346 or CVE-2024-56347. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: AIX NIM Service Spawning Shell With Download or Reverse Shell Tooling
description: Detects the AIX NIM daemons (nimesis, nimsh) spawning child processes
  whose command lines contain download-and-execute, reverse shell or netcat patterns.
  Generalises on the parent/child relation and post-exploitation command patterns,
  not on specific payloads. Requires AIX process telemetry forwarded in a Linux-style
  process_creation format.
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ibm-aix-could-allow-for-arbitrary-code-execution_2025-033
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /nimesis
    - /nimsh
  selection_cmd:
    CommandLine|contains:
    - /dev/tcp/
    - nc -e
    - ncat -e
    - 'curl '
    - 'wget '
    - 'tftp '
    - mkfifo
    - base64 -d
    - perl -e
    - python -c
  condition: selection_parent and selection_cmd
falsepositives:
- NIM administrators pushing software or scripts via nimsh that legitimately use wget
  or curl to fetch packages
level: high
id: 5c87bc55-8770-5d9e-839a-3902a6bf1439
status: experimental
author: Vorant
```

### AIX NIM Service Creating or Modifying Privileged Accounts

ATT&CK: T1190

nimesis or nimsh daemons spawning account management commands such as mkuser, chuser, useradd or usermod, indicating possible post-exploitation account creation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: AIX NIM Service Creating or Modifying Privileged Accounts
description: Detects account management commands (mkuser, chuser, useradd, usermod,
  chsec) whose parent process is the AIX NIM daemon nimesis or nimsh. The advisory
  notes exploitation may allow creation of new privileged accounts. Requires AIX process
  telemetry forwarded in a Linux-style process_creation format.
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ibm-aix-could-allow-for-arbitrary-code-execution_2025-033
tags:
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1136.001
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /nimesis
    - /nimsh
  selection_child:
    Image|endswith:
    - /mkuser
    - /chuser
    - /useradd
    - /usermod
    - /chsec
    - /chgroup
  selection_shell:
    CommandLine|contains:
    - mkuser
    - chuser
    - useradd
    - usermod
    - chsec
  condition: selection_parent and (selection_child or selection_shell)
falsepositives:
- Rare NIM-driven provisioning scripts that create local service accounts on newly
  installed clients
level: high
id: 42e0f938-384b-59ed-9b59-5194964510f2
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-ibm-aix-could-allow-for-arbitrary-code-execution_2025-033

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1817dae2-06cf-56ec-a8b5-3c9355ad9eb8/ibm-aix-nimesis-and-nimsh-services-allow-arbitrary-code-execution.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup