Description
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to improperly scrubbed environment variables.
Published: 2026-08-19
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises from improperly scrubbed environment variables on IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1. A compromised local user can manipulate these variables to inject malicious code that the operating system will execute. This allows the attacker to run arbitrary code with the privileges of the affected process, potentially compromising confidentiality, integrity and availability.

Affected Systems

Affected products are IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1. The specific releases impacted are AIX 7.2 TL05 SP13, AIX 7.3 TL04 SP2, AIX 7.3 TL03 SP3, AIX 7.3 TL02 SP5. For VIOS the affected levels are 4.1.0 with 4.1.0.50 patch, 4.1.1 with 4.1.1.30, and 4.1.2 with 4.1.2.20. These are cumulative service pack and fix pack releases that contain the fix.

Risk and Exploitability

The CVSS score is 7.8, indicating high severity. EPSS is not available so the exact exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local, inferred from the description that a local attacker must manipulate environment variables. Once the environment variable sanitisation bypass is achieved, arbitrary code runs with the privileges of the local process, potentially enabling privilege escalation. IBM strongly recommends addressing the vulnerability now with the provided patches and reboot or Live Update where necessary.

Generated by OpenCVE AI on August 20, 2026 at 11:56 UTC.

Remediation

Vendor Solution

A.  APARS IBM has assigned the following APARs to this problem: AIX LevelAPARAvailability  SPKEY7.2.5IJ5956608/14/2026SP13key_w_apar7.3.2IJ5956508/14/2026SP05key_w_apar7.3.3IJ5956408/14/2026SP03key_w_apar7.3.4IJ59563 08/14/2026SP02key_w_apar VIOS LevelAPARAvailability SPKEY4.1.0IJ5956508/14/20264.1.0.50key_w_apar4.1.1IJ5956408/14/20264.1.1.30key_w_apar4.1.2IJ5956308/14/20264.1.2.20key_w_apar B.  FIXES IBM strongly recommends addressing the vulnerability now.  AIX and VIOS fixes are available and can be downloaded from Fix Central: https://www.ibm.com/support/fixcentral  An LPAR reboot is required to complete the SP/FP update. On AIX, Live Update can be used to avoid a reboot.  IBM has assigned the following AIX Service Packs (SPs) and VIOS Fix Packs (FPs) as the remediation levels for the published vulnerabilities. AIX Level Service PackAIX 7.3 TL04SP2AIX 7.3 TL03SP3AIX 7.3 TL02SP5AIX 7.2 TL05 SP13 PowerVM VIOS LevelFix PackVIOS 4.1.2 4.1.2.20VIOS 4.1.1 4.1.1.30VIOS 4.1.0  4.1.0.50 Note: These SPs/FPs are cumulative and include fixes for all previously published AIX/VIOS security vulnerabilities. They can be applied on top of any earlier affected level of the TL . Note: To apply these patches using nimsh secure, special steps must be taken as the protocol between master and client is updated to be more secure. Please read this article: https://www.ibm.com/support/pages/node/7283157 Note: For VIOS 4.1.0 and VIOS 4.1.1, additional steps are required to migrate to the latest Postgres15 after applying the 4.1.1.30 or 4.1.0.50 FPs above. Instructions to do that can be found here:                             4.1.0.50 post-update instructions: https://www.ibm.com/support/pages/node/7283819           4.1.1.30 post-update instructions: https://www.ibm.com/support/pages/node/7283823

OpenCVE Recommended Actions

  • Download the appropriate IBM AIX Service Pack or VIOS Fix Pack from Fix Central and apply it to the affected hosts.
  • For AIX, apply the patches using Live Update to avoid an LPAR reboot, or perform an LPAR reboot if Live Update cannot be used.
  • After applying the VIOS 4.1.0 or 4.1.1 patch, run the Postgres15 migration steps as described in the IBM support articles to complete the update.
  • Adjust any custom scripts or system configurations to ensure environment variables such as PATH are scrubbed or set to trusted values before being passed to processes, mitigating CWE‑426 related risks.
  • Read and implement the specific nimsh secure protocol configuration changes if nimsh is used on the system.

Generated by OpenCVE AI on August 20, 2026 at 11:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Ibm vios
CPEs cpe:2.3:a:ibm:vios:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:*
Vendors & Products Ibm vios

Wed, 19 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to improperly scrubbed environment variables.
Title Vulnerabilities in IBM AIX and PowerVM VIOS
First Time appeared Ibm
Ibm aix
Ibm powervm Vios
Weaknesses CWE-426
CPEs cpe:2.3:a:ibm:aix:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm aix
Ibm powervm Vios
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Aix Powervm Vios Vios
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-22T03:55:30.815Z

Reserved: 2026-07-24T04:19:21.734Z

Link: CVE-2026-16869

cve-icon Vulnrichment

Updated: 2026-08-20T15:49:56.387Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-19T20:17:08.120

Modified: 2026-08-22T04:17:25.373

Link: CVE-2026-16869

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T12:00:04Z

Weaknesses