Description
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper validation of network-supplied pointers.
Published: 2026-08-19
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 allows a remote attacker to execute arbitrary code by providing network‑supplied pointers that are improperly validated. This flaw can lead to full system compromise, resulting in loss of confidentiality, integrity, and availability.

Affected Systems

Affected systems include IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1. The advisory specifies remediation through specific service packs and fix packs: AIX 7.3 TL04SP2, TL03SP3, or TL02SP5; AIX 7.2 TL05 SP13; VIOS 4.1.2 FP 4.1.2.20; VIOS 4.1.1 FP 4.1.1.30; and VIOS 4.1.0 FP 4.1.0.50. These patches are cumulative and are available from IBM Fix Central.

Risk and Exploitability

The CVSS score of 9.8 indicates a critical severity. EPSS data is not available, so the probability of exploitation cannot be quantified from this metric, but the vulnerability is listed as not being in CISA KEV. The flaw is a remote code execution vector that can be triggered over the network, making it highly actionable for an attacker with network access to the vulnerable host.

Generated by OpenCVE AI on August 20, 2026 at 11:28 UTC.

Remediation

Vendor Solution

A.  APARS IBM has assigned the following APARs to this problem: AIX LevelAPARAvailability  SPKEY7.2.5IJ5956608/14/2026SP13key_w_apar7.3.2IJ5956508/14/2026SP05key_w_apar7.3.3IJ5956408/14/2026SP03key_w_apar7.3.4IJ59563 08/14/2026SP02key_w_apar VIOS LevelAPARAvailability SPKEY4.1.0IJ5956508/14/20264.1.0.50key_w_apar4.1.1IJ5956408/14/20264.1.1.30key_w_apar4.1.2IJ5956308/14/20264.1.2.20key_w_apar B.  FIXES IBM strongly recommends addressing the vulnerability now.  AIX and VIOS fixes are available and can be downloaded from Fix Central: https://www.ibm.com/support/fixcentral  An LPAR reboot is required to complete the SP/FP update. On AIX, Live Update can be used to avoid a reboot.  IBM has assigned the following AIX Service Packs (SPs) and VIOS Fix Packs (FPs) as the remediation levels for the published vulnerabilities. AIX Level Service PackAIX 7.3 TL04SP2AIX 7.3 TL03SP3AIX 7.3 TL02SP5AIX 7.2 TL05 SP13 PowerVM VIOS LevelFix PackVIOS 4.1.2 4.1.2.20VIOS 4.1.1 4.1.1.30VIOS 4.1.0  4.1.0.50 Note: These SPs/FPs are cumulative and include fixes for all previously published AIX/VIOS security vulnerabilities. They can be applied on top of any earlier affected level of the TL . Note: To apply these patches using nimsh secure, special steps must be taken as the protocol between master and client is updated to be more secure. Please read this article: https://www.ibm.com/support/pages/node/7283157 Note: For VIOS 4.1.0 and VIOS 4.1.1, additional steps are required to migrate to the latest Postgres15 after applying the 4.1.1.30 or 4.1.0.50 FPs above. Instructions to do that can be found here:                             4.1.0.50 post-update instructions: https://www.ibm.com/support/pages/node/7283819           4.1.1.30 post-update instructions: https://www.ibm.com/support/pages/node/7283823

OpenCVE Recommended Actions

  • Apply the applicable AIX or VIOS fix pack that contains the vulnerability fix, such as AIX 7.3 TL04SP2 or VIOS 4.1.2 FP 4.1.2.20, following the download and installation instructions from IBM Fix Central.
  • If the system is an LPAR, reboot after the update; on AIX use Live Update to avoid downtime where possible.
  • For VIOS 4.1.0 and 4.1.1, run the post‑update migration to Postgres 15 using the link‑provided instructions.
  • Deploy network controls to block traffic that may exploit the vulnerable logic until the patch is applied, and monitor logs for related exploitation attempts.

Generated by OpenCVE AI on August 20, 2026 at 11:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Ibm vios
CPEs cpe:2.3:a:ibm:vios:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:*
Vendors & Products Ibm vios

Wed, 19 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
Description IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper validation of network-supplied pointers.
Title Vulnerabilities in IBM AIX and PowerVM VIOS
First Time appeared Ibm
Ibm aix
Ibm powervm Vios
Weaknesses CWE-843
CPEs cpe:2.3:a:ibm:aix:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm aix
Ibm powervm Vios
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Aix Powervm Vios Vios
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-19T19:57:23.384Z

Reserved: 2026-07-24T06:58:19.637Z

Link: CVE-2026-16919

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-08-19T20:17:11.650

Modified: 2026-08-20T15:53:38.983

Link: CVE-2026-16919

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T11:30:16Z

Weaknesses
  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')