CVE-2026-16706: Vulnerabilities in IBM AIX and PowerVM VIOS

Q: Which systems should be prioritized for assessment?

IBM AIX and IBM PowerVM VIOS are identified as affected software.

Q: Does exploitation require an attacker to have local access?

The issue is described as exploitable by a remote attacker, so local access is not indicated as a requirement.

Published Aug 15, 2026

Updated

AIX could allow a remote attacker to cause a denial of service due to an out-of-bounds write.

Other sources

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.

— MITRE

Affected Software

3 affected components

IBM AIX<=7.2

IBM AIX<=7.3

IBM PowerVM VIOS<=4.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM AIX to a version that resolves this vulnerability.
Patch SPKEY7.2.5
Upgrade
Upgrade IBM PowerVM VIOS to a version that resolves this vulnerability.
Fixed in 4.1.0.50Patch 4.1.0.50key_w_apar
Upgrade
Upgrade IBM PowerVM VIOS to a version that resolves this vulnerability.
Fixed in 4.1.1.30Patch 4.1.1.30key_w_apar
Upgrade
Upgrade IBM PowerVM VIOS to a version that resolves this vulnerability.
Fixed in 4.1.2.20Patch 4.1.2.20key_w_apar
Operational
Reboot the LPAR to complete the SP/FP update (an LPAR reboot is required to complete the SP/FP update).
Operational
For VIOS 4.1.0 and VIOS 4.1.1, perform the additional steps required to migrate to the latest Postgres15 after applying the 4.1.0.50 or 4.1.1.30 FPs.

Event History

Aug 15, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Aug 19, 2026

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

RemedyDescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7283858

Frequently Asked Questions

Which systems should be prioritized for assessment?