CVE-2026-16814: Vulnerabilities in IBM AIX and PowerVM VIOS
AIX could allow a remote attacker to execute arbitrary code due to a heap buffer overflow.
Other sources
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM PowerVM VIOS 4.1.0to a version that resolves this vulnerability.Fixed in 4.1.0.50 - Upgrade
Upgrade
IBM PowerVM VIOS 4.1.1to a version that resolves this vulnerability.Fixed in 4.1.1.30 - Compensating control
Perform the required LPAR reboot to complete the SP/FP update (AIX/VIOS post-update requires an LPAR reboot).
- Operational
For VIOS 4.1.0 and VIOS 4.1.1, after applying the 4.1.0.50 or 4.1.1.30 FPs, perform the additional steps required to migrate to the latest Postgres15.
Event History
Frequently Asked Questions
Which IBM systems should be included in triage?
IBM AIX and IBM PowerVM VIOS are listed as affected software.
Does an attacker need local access to exploit this issue?
The issue is described as exploitable by a remote attacker.