Description
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to uncontrolled resource consumption.
Published: 2026-08-20
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an instance of uncontrolled resource consumption in IBM AIX 7.2 and 7.3, and PowerVM VIOS 4.1. An attacker with local privileges can trigger excessive resource usage that leads to a denial of service, making the affected system unresponsive or unusable. The weakness is classified as CWE-400 and does not provide persistence or gain of additional privileges, but it can disrupt availability for users and applications running on the hardware.

Affected Systems

IBM AIX versions 7.2 and 7.3, including all intermediate service packs, and IBM PowerVM VIOS 4.1, including SP4.1.0, SP4.1.1, and SP4.1.2 are impacted. The specific fix levels are listed in the IBM Advisory and include a range of Service Packs for AIX and Fix Packs for VIOS.

Risk and Exploitability

The CVSS score of 5.5 indicates a moderate severity, and the EPSS score is not available, suggesting limited public exploitation data. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local, requiring the attacker to have privileged access to the system. When exploited, the denial of service can affect a single user session or bring down an entire virtual machine or host, depending on the environment. The time and effort required to exploit are low, and the impact is immediate once resource limits are overwhelmed.

Generated by OpenCVE AI on August 20, 2026 at 23:57 UTC.

Remediation

Vendor Solution

A.  APARS IBM has assigned the following APARs to this problem: AIX LevelAPARAvailability  SPKEY7.2.5IJ5956608/14/2026SP13key_w_apar7.3.2IJ5956508/14/2026SP05key_w_apar7.3.3IJ5956408/14/2026SP03key_w_apar7.3.4IJ59563 08/14/2026SP02key_w_apar VIOS LevelAPARAvailability SPKEY4.1.0IJ5956508/14/20264.1.0.50key_w_apar4.1.1IJ5956408/14/20264.1.1.30key_w_apar4.1.2IJ5956308/14/20264.1.2.20key_w_apar B.  FIXES IBM strongly recommends addressing the vulnerability now.  AIX and VIOS fixes are available and can be downloaded from Fix Central: https://www.ibm.com/support/fixcentral  An LPAR reboot is required to complete the SP/FP update. On AIX, Live Update can be used to avoid a reboot.  IBM has assigned the following AIX Service Packs (SPs) and VIOS Fix Packs (FPs) as the remediation levels for the published vulnerabilities. AIX Level Service PackAIX 7.3 TL04SP2AIX 7.3 TL03SP3AIX 7.3 TL02SP5AIX 7.2 TL05 SP13 PowerVM VIOS LevelFix PackVIOS 4.1.2 4.1.2.20VIOS 4.1.1 4.1.1.30VIOS 4.1.0  4.1.0.50 Note: These SPs/FPs are cumulative and include fixes for all previously published AIX/VIOS security vulnerabilities. They can be applied on top of any earlier affected level of the TL . Note: To apply these patches using nimsh secure, special steps must be taken as the protocol between master and client is updated to be more secure. Please read this article: https://www.ibm.com/support/pages/node/7283157 Note: For VIOS 4.1.0 and VIOS 4.1.1, additional steps are required to migrate to the latest Postgres15 after applying the 4.1.1.30 or 4.1.0.50 FPs above. Instructions to do that can be found here:                             4.1.0.50 post-update instructions: https://www.ibm.com/support/pages/node/7283819           4.1.1.30 post-update instructions: https://www.ibm.com/support/pages/node/7283823


OpenCVE Recommended Actions

  • Download and apply the applicable AIX Service Pack or PowerVM VIOS Fix Pack from IBM Fix Central
  • If running AIX, use Live Update to avoid a system reboot; otherwise perform a normal LPAR reboot after the update
  • For VIOS 4.1.0 or 4.1.1, follow IBM’s post‑update guidance to migrate to Postgres15, reviewing the specific instructions for 4.1.0.50 and 4.1.1.30

Generated by OpenCVE AI on August 20, 2026 at 23:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Ibm vios
CPEs cpe:2.3:a:ibm:vios:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:*
Vendors & Products Ibm vios

Fri, 21 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Thu, 20 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Description IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to uncontrolled resource consumption.
Title Vulnerabilities in IBM AIX and PowerVM VIOS
First Time appeared Ibm
Ibm aix
Ibm powervm Vios
Weaknesses CWE-400
CPEs cpe:2.3:a:ibm:aix:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm aix
Ibm powervm Vios
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}


cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-21T15:46:24.495Z

Reserved: 2026-07-24T08:07:07.574Z

Link: CVE-2026-16952

cve-icon Vulnrichment

Updated: 2026-08-21T15:46:07.596Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-20T22:17:09.140

Modified: 2026-08-24T17:22:06.830

Link: CVE-2026-16952

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T00:00:05Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption