Description
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a format string vulnerability.
Published: 2026-08-20
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A format string flaw in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 allows an attacker with network access to execute arbitrary code on the affected system. The weakness, classified as CWE‑134, can lead to full compromise of confidentiality, integrity and availability on both the host and any virtual machines running on it. The description explicitly states that the flaw enables arbitrary code execution if exploited.

Affected Systems

The vulnerable products are IBM AIX 7.2 and 7.3 at the specified SP/TL levels (AIX 7.3 TL04 SP2, AIX 7.3 TL03 SP3, AIX 7.3 TL02 SP5, AIX 7.2 TL05 SP13) and IBM PowerVM VIOS 4.1 at FP levels (VIOS 4.1 FP 4.1.1.30, VIOS 4.1.0 FP 4.1.0.50, VIOS 4.1.2 FP 4.1.2.20). Patching the service packs or fix packs is required to remediate the issue.

Risk and Exploitability

The CVSS score of 9.8 indicates a critical severity. The EPSS score is not available, but the vulnerability is listed as not in the CISA KEV database. The attack is likely remote, requiring connectivity to a vulnerable service or component within AIX or VIOS; the description does not detail the exact vector, so this is inferred based on the nature of format string exploits.

Generated by OpenCVE AI on August 20, 2026 at 23:43 UTC.

Remediation

Vendor Solution

A.  APARS IBM has assigned the following APARs to this problem: AIX LevelAPARAvailability  SPKEY7.2.5IJ5956608/14/2026SP13key_w_apar7.3.2IJ5956508/14/2026SP05key_w_apar7.3.3IJ5956408/14/2026SP03key_w_apar7.3.4IJ59563 08/14/2026SP02key_w_apar VIOS LevelAPARAvailability SPKEY4.1.0IJ5956508/14/20264.1.0.50key_w_apar4.1.1IJ5956408/14/20264.1.1.30key_w_apar4.1.2IJ5956308/14/20264.1.2.20key_w_apar B.  FIXES IBM strongly recommends addressing the vulnerability now.  AIX and VIOS fixes are available and can be downloaded from Fix Central: https://www.ibm.com/support/fixcentral  An LPAR reboot is required to complete the SP/FP update. On AIX, Live Update can be used to avoid a reboot.  IBM has assigned the following AIX Service Packs (SPs) and VIOS Fix Packs (FPs) as the remediation levels for the published vulnerabilities. AIX Level Service PackAIX 7.3 TL04SP2AIX 7.3 TL03SP3AIX 7.3 TL02SP5AIX 7.2 TL05 SP13 PowerVM VIOS LevelFix PackVIOS 4.1.2 4.1.2.20VIOS 4.1.1 4.1.1.30VIOS 4.1.0  4.1.0.50 Note: These SPs/FPs are cumulative and include fixes for all previously published AIX/VIOS security vulnerabilities. They can be applied on top of any earlier affected level of the TL . Note: To apply these patches using nimsh secure, special steps must be taken as the protocol between master and client is updated to be more secure. Please read this article: https://www.ibm.com/support/pages/node/7283157 Note: For VIOS 4.1.0 and VIOS 4.1.1, additional steps are required to migrate to the latest Postgres15 after applying the 4.1.1.30 or 4.1.0.50 FPs above. Instructions to do that can be found here:                             4.1.0.50 post-update instructions: https://www.ibm.com/support/pages/node/7283819           4.1.1.30 post-update instructions: https://www.ibm.com/support/pages/node/7283823

OpenCVE Recommended Actions

  • Apply the latest applicable AIX Service Pack or PowerVM VIOS Fix Pack as listed in the advisory (for example, AIX 7.3 TL04 SP2 or VIOS 4.1.1 FP 4.1.1.30).
  • If a reboot is required after installing the updates, perform an LPAR reboot; for AIX use Live Update to avoid downtime where possible.
  • For VIOS 4.1 0 and 4.1 1, after installing the FP, follow IBM’s post‑update instructions to migrate to Postgres 15 using the provided links.

Generated by OpenCVE AI on August 20, 2026 at 23:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Ibm vios
CPEs cpe:2.3:a:ibm:vios:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:*
Vendors & Products Ibm vios

Fri, 21 Aug 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a format string vulnerability.
Title Vulnerabilities in IBM AIX and PowerVM VIOS
First Time appeared Ibm
Ibm aix
Ibm powervm Vios
Weaknesses CWE-134
CPEs cpe:2.3:a:ibm:aix:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm aix
Ibm powervm Vios
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Aix Powervm Vios Vios
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-25T03:56:11.106Z

Reserved: 2026-07-24T17:01:20.432Z

Link: CVE-2026-17136

cve-icon Vulnrichment

Updated: 2026-08-21T11:10:33.522Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-20T22:17:13.017

Modified: 2026-08-25T13:51:11.873

Link: CVE-2026-17136

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T00:15:03Z

Weaknesses
  • CWE-134

    Use of Externally-Controlled Format String