CVE-2026-16839: Vulnerabilities in IBM AIX and PowerVM VIOS
Published Aug 15, 2026
·Updated
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to an integer underflow in the IPv4 IP-options parser.
Affected Software
10 affected components
IBM AIX<=7.2
IBM AIX<=7.3
IBM PowerVM VIOS<=4.1
IBM AIX>=7.2.5<=7.2.5.212
IBM AIX>=7.3.2<=7.3.2.5
IBM AIX>=7.3.3<=7.3.3.2
IBM AIX>=7.3.4<=7.3.4.1
IBM VIOS>=4.1.0<4.1.0.50
IBM VIOS>=4.1.1.0<4.1.1.30
IBM VIOS>=4.1.2.0<4.1.2.20
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM PowerVM VIOS 4.1.0to a version that resolves this vulnerability.Fixed in 4.1.0.50 - Upgrade
Upgrade
IBM PowerVM VIOS 4.1.1to a version that resolves this vulnerability.Fixed in 4.1.1.30Patch key_w_apar4.1.1IJ5956408/14/20264.1.1.30 - Upgrade
Upgrade
IBM PowerVM VIOS 4.1.2to a version that resolves this vulnerability.Fixed in 4.1.2.20Patch key_w_apar4.1.2IJ5956308/14/20264.1.2.20 - Upgrade
Upgrade
IBM AIX 7.3 TL03 SP3to a version that resolves this vulnerability.Patch key_w_apar7.3.3IJ5956408/14/2026 - Operational
Reboot the LPAR to complete the SP/FP update.
- Operational
For VIOS 4.1.0 and VIOS 4.1.1, follow the additional steps required to migrate to the latest Postgres15 after applying the 4.1.0.50 or 4.1.1.30 FPs.
Event History
Aug 15, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Aug 19, 2026
CVE Published
via MITRE·07:30 PM
Data Sourced
via MITRE·07:30 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·08:17 PM
RemedyDescriptionSeverityWeaknessAffected Software