CVE-2026-16824: Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to unbounded recursion.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.0.50Patch IJ5956508/14/2026 - Upgrade
Upgrade
IBM PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.1.30Patch IJ5956408/14/2026 - Upgrade
Upgrade
IBM PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.2.20Patch IJ5956308/14/2026 - Operational
Reboot the LPAR to complete the AIX Service Pack / VIOS Fix Pack update (LPAR reboot is required to complete the SP/FP update).
- Operational
For VIOS 4.1.0 and VIOS 4.1.1, perform the additional required steps to migrate to the latest Postgres15 after applying the 4.1.0.50 or 4.1.1.30 FPs.
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The issue is described as remotely exploitable, so an attacker does not need local access. The provided information does not specify whether authentication or any particular network service is required.
Which IBM products should be reviewed for exposure?
IBM AIX and IBM PowerVM VIOS are listed as affected software. The provided information does not identify affected versions, configurations, or services.
What is the likely security impact?
The stated impact is denial of service caused by unbounded recursion. The provided information does not indicate confidentiality impact, privilege escalation, or code execution.