CVE-2026-16827: Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to the use of an uninitialized stack pointer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AIX 7.2 TL05to a version that resolves this vulnerability.Fixed in SP13Patch KEY7.2.5IJ5956608/14/2026 - Upgrade
Upgrade
AIX 7.3 TL04to a version that resolves this vulnerability.Fixed in SP2Patch IJ5956508/14/2026 - Upgrade
Upgrade
AIX 7.3 TL03to a version that resolves this vulnerability.Fixed in SP3Patch IJ5956408/14/2026 - Upgrade
Upgrade
AIX 7.3 TL02to a version that resolves this vulnerability.Fixed in SP5Patch IJ59563 - Upgrade
Upgrade
PowerVM VIOS 4.1.0to a version that resolves this vulnerability.Fixed in 4.1.0.50 - Upgrade
Upgrade
PowerVM VIOS 4.1.1to a version that resolves this vulnerability.Fixed in 4.1.1.30Patch key_w_apar4.1.1IJ5956408/14/2026 - Upgrade
Upgrade
PowerVM VIOS 4.1.2to a version that resolves this vulnerability.Fixed in 4.1.2.20Patch key_w_apar4.1.2IJ5956308/14/2026 - Operational
An LPAR reboot is required to complete the SP/FP update (per the provided AIX/VIOS remediation instructions).
- Operational
If using VIOS 4.1.0 or VIOS 4.1.1, perform the additional steps required to migrate to the latest Postgres15 after applying the 4.1.0.50 or 4.1.1.30 FPs.
Event History
Frequently Asked Questions
Which deployments should be assessed for exposure?
The affected software list identifies IBM AIX and IBM PowerVM VIOS. The provided data does not specify affected versions or configurations.
What level of attacker access is indicated?
The issue is described as exploitable by a remote attacker. The provided data does not state whether authentication, privileges, or user interaction are required.