Description
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 allows a remote unauthenticated attacker can send a crafted UDP packet to a reachable RPC service, resulting in complete system unavailability and requiring an LPAR restart.
Published: 2026-08-20
Score: 7.5 High
EPSS: 1.0% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability allows a remote unauthenticated attacker to send a crafted UDP packet to a reachable RPC service in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1, causing the target system to become completely unavailable and requiring a logical partition restart. The weakness is identified as CWE-400, and the impact is a denial of service that could disrupt critical platform operations.

Affected Systems

Affected vendors include IBM. The products impacted are IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1. Service pack and fix pack remediation levels are AIX 7.3 TL04SP2, TL03SP3, TL02SP5, AIX 7.2 TL05 SP13, and PowerVM VIOS 4.1.2 4.1.2.20, 4.1.1 4.1.1.30, and 4.1.0 4.1.0.50. These updates are cumulative and can be applied on top of any earlier affected level. No additional version details are supplied beyond the listed SP/FP names.

Risk and Exploitability

The CVSS score of 7.5 places this issue in the high‑severity range. The EPSS score of 1% indicates a very low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly recorded exploits at this time. Nonetheless, the attack requires only a UDP packet to a reachable RPC service and no authentication, so any affected system is susceptible. Recovery is costly, as the LPAR must be restarted, which further disrupts availability.

Generated by OpenCVE AI on August 21, 2026 at 14:37 UTC.

Remediation

Vendor Solution

A.  APARS IBM has assigned the following APARs to this problem: AIX LevelAPARAvailability  SPKEY7.2.5IJ5956608/14/2026SP13key_w_apar7.3.2IJ5956508/14/2026SP05key_w_apar7.3.3IJ5956408/14/2026SP03key_w_apar7.3.4IJ59563 08/14/2026SP02key_w_apar VIOS LevelAPARAvailability SPKEY4.1.0IJ5956508/14/20264.1.0.50key_w_apar4.1.1IJ5956408/14/20264.1.1.30key_w_apar4.1.2IJ5956308/14/20264.1.2.20key_w_apar B.  FIXES IBM strongly recommends addressing the vulnerability now.  AIX and VIOS fixes are available and can be downloaded from Fix Central: https://www.ibm.com/support/fixcentral  An LPAR reboot is required to complete the SP/FP update. On AIX, Live Update can be used to avoid a reboot.  IBM has assigned the following AIX Service Packs (SPs) and VIOS Fix Packs (FPs) as the remediation levels for the published vulnerabilities. AIX Level Service PackAIX 7.3 TL04SP2AIX 7.3 TL03SP3AIX 7.3 TL02SP5AIX 7.2 TL05 SP13 PowerVM VIOS LevelFix PackVIOS 4.1.2 4.1.2.20VIOS 4.1.1 4.1.1.30VIOS 4.1.0  4.1.0.50 Note: These SPs/FPs are cumulative and include fixes for all previously published AIX/VIOS security vulnerabilities. They can be applied on top of any earlier affected level of the TL . Note: To apply these patches using nimsh secure, special steps must be taken as the protocol between master and client is updated to be more secure. Please read this article: https://www.ibm.com/support/pages/node/7283157 Note: For VIOS 4.1.0 and VIOS 4.1.1, additional steps are required to migrate to the latest Postgres15 after applying the 4.1.1.30 or 4.1.0.50 FPs above. Instructions to do that can be found here:                             4.1.0.50 post-update instructions: https://www.ibm.com/support/pages/node/7283819           4.1.1.30 post-update instructions: https://www.ibm.com/support/pages/node/7283823

OpenCVE Recommended Actions

  • Apply the latest AIX Service Pack (e.g., AIX 7.3 TL04SP2 or AIX 7.2 TL05 SP13) or the equivalent PowerVM VIOS Fix Pack (e.g., VIOS 4.1.2 4.1.2.20) from IBM Fix Central.
  • Restart the logical partition after the Service Pack or Fix Pack installation, or use AIX Live Update to avoid a reboot if available.
  • If updating VIOS 4.1.0 or 4.1.1, follow the post‑update migration instructions to upgrade to Postgres15 as outlined in the advisory.

Generated by OpenCVE AI on August 21, 2026 at 14:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Ibm vios
CPEs cpe:2.3:a:ibm:vios:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:*
Vendors & Products Ibm vios

Thu, 20 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 allows a remote unauthenticated attacker can send a crafted UDP packet to a reachable RPC service, resulting in complete system unavailability and requiring an LPAR restart.
Title Vulnerabilities in IBM AIX and PowerVM VIOS
First Time appeared Ibm
Ibm aix
Ibm powervm Vios
Weaknesses CWE-400
CPEs cpe:2.3:a:ibm:aix:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm aix
Ibm powervm Vios
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Ibm Aix Powervm Vios Vios
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-21T14:55:17.387Z

Reserved: 2026-08-10T13:37:37.902Z

Link: CVE-2026-19446

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-08-20T22:17:18.273

Modified: 2026-08-25T19:31:00.750

Link: CVE-2026-19446

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T14:45:16Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption