Description
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of shell metacharacters in DHCP options.
Published: 2026-08-19
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw stems from improper neutralization of shell metacharacters in DHCP options that an AIX or PowerVM VIOS system accepts. When a remote host supplies crafted DHCP options, the shell on the target system is invoked with unescaped metacharacters, allowing execution of arbitrary commands. This yields full control of the operating environment, compromising the confidentiality, integrity, and availability of the affected system.

Affected Systems

IBM AIX 7.2 and 7.3 on any Technology Level with Service Packs prior to the levels listed in the APARs, and IBM PowerVM VIOS 4.1 versions 4.1.0, 4.1.1, and 4.1.2 on any Fix Pack prior to the referenced FP numbers.

Risk and Exploitability

The CVSS score of 8.8 places this vulnerability in the high severity range. The EPSS score is not currently available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote exploitation via DHCP traffic, inferred from the description that DHCP options are the source of the metacharacter injection. An attacker can trigger the flaw from any network location that can send DHCP messages to the target system, making remediation urgent.

Generated by OpenCVE AI on August 20, 2026 at 12:03 UTC.

Remediation

Vendor Solution

A.  APARS IBM has assigned the following APARs to this problem: AIX LevelAPARAvailability  SPKEY7.2.5IJ5956608/14/2026SP13key_w_apar7.3.2IJ5956508/14/2026SP05key_w_apar7.3.3IJ5956408/14/2026SP03key_w_apar7.3.4IJ59563 08/14/2026SP02key_w_apar VIOS LevelAPARAvailability SPKEY4.1.0IJ5956508/14/20264.1.0.50key_w_apar4.1.1IJ5956408/14/20264.1.1.30key_w_apar4.1.2IJ5956308/14/20264.1.2.20key_w_apar B.  FIXES IBM strongly recommends addressing the vulnerability now.  AIX and VIOS fixes are available and can be downloaded from Fix Central: https://www.ibm.com/support/fixcentral  An LPAR reboot is required to complete the SP/FP update. On AIX, Live Update can be used to avoid a reboot.  IBM has assigned the following AIX Service Packs (SPs) and VIOS Fix Packs (FPs) as the remediation levels for the published vulnerabilities. AIX Level Service PackAIX 7.3 TL04SP2AIX 7.3 TL03SP3AIX 7.3 TL02SP5AIX 7.2 TL05 SP13 PowerVM VIOS LevelFix PackVIOS 4.1.2 4.1.2.20VIOS 4.1.1 4.1.1.30VIOS 4.1.0  4.1.0.50 Note: These SPs/FPs are cumulative and include fixes for all previously published AIX/VIOS security vulnerabilities. They can be applied on top of any earlier affected level of the TL . Note: To apply these patches using nimsh secure, special steps must be taken as the protocol between master and client is updated to be more secure. Please read this article: https://www.ibm.com/support/pages/node/7283157 Note: For VIOS 4.1.0 and VIOS 4.1.1, additional steps are required to migrate to the latest Postgres15 after applying the 4.1.1.30 or 4.1.0.50 FPs above. Instructions to do that can be found here:                             4.1.0.50 post-update instructions: https://www.ibm.com/support/pages/node/7283819           4.1.1.30 post-update instructions: https://www.ibm.com/support/pages/node/7283823

OpenCVE Recommended Actions

  • Apply the IBM AIX Service Pack or PowerVM VIOS Fix Pack specified in the APARs; for AIX, Service Pack levels such as AIX 7.3 TL04SP2, AIX 7.3 TL03SP3, AIX 7.3 TL02SP5, or AIX 7.2 TL05 SP13, and for VIOS, Fix Pack levels such as VIOS 4.1.2 4.1.2.20, VIOS 4.1.1 4.1.1.30, or VIOS 4.1.0 4.1.0.50. Download the updates from IBM Fix Central and install them.
  • If the system is AIX, use Live Update to apply the Service Pack without rebooting; otherwise perform a full LPAR reboot after installing the update to ensure all components are refreshed.
  • For VIOS 4.1.0 and 4.1.1, after applying the Fix Pack, execute the post‑update migration to Postgres 15 using the provided instructions at the IBM support pages for 4.1.0.50 and 4.1.1.30.
  • Follow the guidance for nimsh secure after installing the update, ensuring the enhanced security protocol between master and client is applied as described in IBM’s support article.

Generated by OpenCVE AI on August 20, 2026 at 12:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Ibm vios
CPEs cpe:2.3:a:ibm:vios:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:*
Vendors & Products Ibm vios

Thu, 20 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of shell metacharacters in DHCP options.
Title Vulnerabilities in IBM AIX and PowerVM VIOS
First Time appeared Ibm
Ibm aix
Ibm powervm Vios
Weaknesses CWE-78
CPEs cpe:2.3:a:ibm:aix:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm aix
Ibm powervm Vios
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Aix Powervm Vios Vios
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-22T03:55:33.116Z

Reserved: 2026-07-24T03:15:34.464Z

Link: CVE-2026-16848

cve-icon Vulnrichment

Updated: 2026-08-20T15:50:38.652Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-19T20:17:06.297

Modified: 2026-08-24T16:01:30.190

Link: CVE-2026-16848

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T12:15:03Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')