CVE-2026-16837

Vulnerabilities in IBM AIX and PowerVM VIOS

View on CVE.org
Published Aug 19, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Description
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper handling of a missing SSL client certificate.

Analysis

AI-generated

Technical impact

The vulnerability allows a remote attacker to cause a denial of service on IBM AIX 7.2, AIX 7.3, and IBM PowerVM VIOS 4.1 servers due to improper handling of a missing SSL client certificate. This is a CWE-400 resource exhaustion weakness, leading to a service disruption that compromises availability of the affected system.

Affected Systems

IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 are affected. The remediation levels are AIX 7.3 TL04 SP2, AIX 7.3 TL03 SP3, AIX 7.3 TL02 SP5, AIX 7.2 TL05 SP13, and VIOS 4.1.2 4.1.2.20, VIOS 4.1.1 4.1.1.30, and VIOS 4.1.0 4.1.0.50. These service packs and fix packs are cumulative, covering all previously published vulnerabilities.

Risk and Exploitability

The CVSS score of 7.5 classifies the vulnerability as high severity. EPSS is not available, so the likelihood of exploitation cannot be quantified, but the absence of a KEV listing suggests no known widespread attacks. The vulnerability requires remote reachability and the ability to initiate a connection that triggers the missing SSL client certificate handling, allowing an attacker to force the system to terminate services and achieve a denial of service.

Remediation

Vendor Solution

A.  APARS IBM has assigned the following APARs to this problem: AIX LevelAPARAvailability  SPKEY7.2.5IJ5956608/14/2026SP13key_w_apar7.3.2IJ5956508/14/2026SP05key_w_apar7.3.3IJ5956408/14/2026SP03key_w_apar7.3.4IJ59563 08/14/2026SP02key_w_apar VIOS LevelAPARAvailability SPKEY4.1.0IJ5956508/14/20264.1.0.50key_w_apar4.1.1IJ5956408/14/20264.1.1.30key_w_apar4.1.2IJ5956308/14/20264.1.2.20key_w_apar B.  FIXES IBM strongly recommends addressing the vulnerability now.  AIX and VIOS fixes are available and can be downloaded from Fix Central: https://www.ibm.com/support/fixcentral  An LPAR reboot is required to complete the SP/FP update. On AIX, Live Update can be used to avoid a reboot.  IBM has assigned the following AIX Service Packs (SPs) and VIOS Fix Packs (FPs) as the remediation levels for the published vulnerabilities. AIX Level Service PackAIX 7.3 TL04SP2AIX 7.3 TL03SP3AIX 7.3 TL02SP5AIX 7.2 TL05 SP13 PowerVM VIOS LevelFix PackVIOS 4.1.2 4.1.2.20VIOS 4.1.1 4.1.1.30VIOS 4.1.0  4.1.0.50 Note: These SPs/FPs are cumulative and include fixes for all previously published AIX/VIOS security vulnerabilities. They can be applied on top of any earlier affected level of the TL . Note: To apply these patches using nimsh secure, special steps must be taken as the protocol between master and client is updated to be more secure. Please read this article: https://www.ibm.com/support/pages/node/7283157 Note: For VIOS 4.1.0 and VIOS 4.1.1, additional steps are required to migrate to the latest Postgres15 after applying the 4.1.1.30 or 4.1.0.50 FPs above. Instructions to do that can be found here:                             4.1.0.50 post-update instructions: https://www.ibm.com/support/pages/node/7283819           4.1.1.30 post-update instructions: https://www.ibm.com/support/pages/node/7283823

OpenCVE Recommended Actions

  • Download and install the applicable IBM AIX Service Pack or PowerVM VIOS Fix Pack from Fix Central.
  • Reboot the affected system, or use Live Update on AIX to complete the update.
  • For VIOS 4.1.0 or 4.1.1, migrate to Postgres15 by following the IBM post‑update instructions on the IBM support pages.
  • If using nimsh secure, follow IBM’s guidelines for the updated protocol steps during patch application.

Generated by OpenCVE AI on August 20, 2026 at 12:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Ibm vios
CPEs cpe:2.3:a:ibm:vios:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:*
Vendors & Products Ibm vios
Type Values Removed Values Added
Description IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper handling of a missing SSL client certificate.
Title Vulnerabilities in IBM AIX and PowerVM VIOS
First Time appeared Ibm
Ibm aix
Ibm powervm Vios
Weaknesses CWE-400
CPEs cpe:2.3:a:ibm:aix:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm aix
Ibm powervm Vios
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}
Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

Sources

Status
PUBLISHED
Assigner
ibm
Published
Updated
Aug 20, 2026, 3:26 PM
Reserved
Jul 24, 2026, 2:53 AM

View source JSON

Updated
Aug 20, 2026, 3:25 PM

JSON

Status
Analyzed
Published
Aug 19, 2026, 8:17 PM
Modified
Oct 26, 2026, 10:10 AM

View source JSON

No data.

Updated
Aug 20, 2026, 12:45 PM

JSON