CVE-2026-16686: Vulnerabilities in IBM AIX and PowerVM VIOS
AIX could allow a remote attacker to access NFS-exported filesystems due to improper authentication.
Other sources
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to access NFS-exported filesystems due to improper authentication.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM PowerVM VIOS 4.1.0to a version that resolves this vulnerability.Fixed in 4.1.0.50 - Upgrade
Upgrade
IBM PowerVM VIOS 4.1.1to a version that resolves this vulnerability.Fixed in 4.1.1.30 - Upgrade
Upgrade
IBM PowerVM VIOS 4.1.2to a version that resolves this vulnerability.Fixed in 4.1.2.20 - Upgrade
Upgrade
IBM AIXto a version that resolves this vulnerability.Patch SPKEY - Upgrade
Upgrade
IBM PowerVM VIOS 4.1.0to a version that resolves this vulnerability.Patch key_w_apar - Upgrade
Upgrade
IBM PowerVM VIOS 4.1.1to a version that resolves this vulnerability.Patch key_w_apar - Upgrade
Upgrade
IBM PowerVM VIOS 4.1.2to a version that resolves this vulnerability.Patch key_w_apar - Operational
For the AIX Service Pack (SP) / VIOS Fix Pack (FP) remediation updates, perform an LPAR reboot to complete the SP/FP update.
- Operational
If running VIOS 4.1.0 or VIOS 4.1.1, complete the additional post-update steps to migrate to the latest Postgres15 after applying the 4.1.0.50 or 4.1.1.30 FPs, respectively (see IBM post-update instructions for 4.1.0.50 and 4.1.1.30).
Event History
Frequently Asked Questions
Which IBM products are identified as affected?
The affected software listed is IBM AIX and IBM PowerVM VIOS.
What environment is exposed to this issue?
Systems with NFS-exported filesystems are exposed to remote access resulting from improper authentication.