Description
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper authentication.
Published: 2026-08-20
Score: 9.8 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability permits a remote attacker to bypass authentication mechanisms and execute arbitrary commands within IBM AIX and PowerVM VIOS, resulting in full control of the affected host. This weakness is classified as Improper Authentication (CWE‑287) and carries a CVSS base score of 9.8, indicating a critical severity.

Affected Systems

IBM AIX 7.2 and 7.3 are affected, with remedial levels ranging from AIX 7.3 TL02SP5 through 7.3 TL04SP2 and AIX 7.2 TL05SP13. IBM PowerVM VIOS 4.1 requires updating to at least Fix Pack 4.1.0.50 for the 4.1.0 line, FP 4.1.1.30 for the 4.1.1 line, and FP 4.1.2.20 for the 4.1.2 line. All patches are cumulative and can be applied on top of earlier service or fix packs.

Risk and Exploitability

The CVSS score of 9.8 demonstrates a highly severe risk. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can exploit this flaw remotely by sending crafted requests that trigger the authentication bypass; the vulnerability affects any system exposed to the network regardless of local user privileges, leading to total compromise of the host.

Generated by OpenCVE AI on August 21, 2026 at 00:21 UTC.

Remediation

Vendor Solution

A.  APARS IBM has assigned the following APARs to this problem: AIX LevelAPARAvailability  SPKEY7.2.5IJ5956608/14/2026SP13key_w_apar7.3.2IJ5956508/14/2026SP05key_w_apar7.3.3IJ5956408/14/2026SP03key_w_apar7.3.4IJ59563 08/14/2026SP02key_w_apar VIOS LevelAPARAvailability SPKEY4.1.0IJ5956508/14/20264.1.0.50key_w_apar4.1.1IJ5956408/14/20264.1.1.30key_w_apar4.1.2IJ5956308/14/20264.1.2.20key_w_apar B.  FIXES IBM strongly recommends addressing the vulnerability now.  AIX and VIOS fixes are available and can be downloaded from Fix Central: https://www.ibm.com/support/fixcentral  An LPAR reboot is required to complete the SP/FP update. On AIX, Live Update can be used to avoid a reboot.  IBM has assigned the following AIX Service Packs (SPs) and VIOS Fix Packs (FPs) as the remediation levels for the published vulnerabilities. AIX Level Service PackAIX 7.3 TL04SP2AIX 7.3 TL03SP3AIX 7.3 TL02SP5AIX 7.2 TL05 SP13 PowerVM VIOS LevelFix PackVIOS 4.1.2 4.1.2.20VIOS 4.1.1 4.1.1.30VIOS 4.1.0  4.1.0.50 Note: These SPs/FPs are cumulative and include fixes for all previously published AIX/VIOS security vulnerabilities. They can be applied on top of any earlier affected level of the TL . Note: To apply these patches using nimsh secure, special steps must be taken as the protocol between master and client is updated to be more secure. Please read this article: https://www.ibm.com/support/pages/node/7283157 Note: For VIOS 4.1.0 and VIOS 4.1.1, additional steps are required to migrate to the latest Postgres15 after applying the 4.1.1.30 or 4.1.0.50 FPs above. Instructions to do that can be found here:                             4.1.0.50 post-update instructions: https://www.ibm.com/support/pages/node/7283819           4.1.1.30 post-update instructions: https://www.ibm.com/support/pages/node/7283823

OpenCVE Recommended Actions

  • Download and apply the appropriate IBM AIX Service Pack or PowerVM VIOS Fix Pack from IBM Fix Central, ensuring the cumulative level meets or exceeds the specified SP/FP thresholds.
  • Follow IBM’s documented patching procedures, including any required nimsh secure protocol steps for LPAR environments; if a full LPAR reboot is not feasible, apply Live Update on AIX to complete the update sequence.
  • After installing the VIOS Fix Pack, perform the Postgres 15 migration using the IBM-provided post‑update instructions for FP 4.1.0.50 or FP 4.1.1.30 before operating the system.

Generated by OpenCVE AI on August 21, 2026 at 00:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper authentication.
Title Vulnerabilities in IBM AIX and PowerVM VIOS
First Time appeared Ibm
Ibm aix
Ibm powervm Vios
Weaknesses CWE-287
CPEs cpe:2.3:a:ibm:aix:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm aix
Ibm powervm Vios
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Aix Powervm Vios
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-20T21:54:07.638Z

Reserved: 2026-07-24T17:18:10.637Z

Link: CVE-2026-17142

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-20T22:17:13.520

Modified: 2026-08-20T22:17:13.520

Link: CVE-2026-17142

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T00:30:07Z

Weaknesses