CVE-2026-16842: Vulnerabilities in IBM AIX and PowerVM VIOS

Q: Which IBM environments should be assessed for exposure?

Assess systems running IBM AIX and IBM PowerVM VIOS.

Q: Does exploitation require an attacker to have local access?

No. The issue is described as remotely exploitable.

Q: What could a successful attacker do?

A successful exploit could allow execution of arbitrary operating-system commands.

Published Aug 15, 2026

Updated

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

Affected Software

10 affected components

IBM AIX<=7.2

IBM AIX<=7.3

IBM PowerVM VIOS<=4.1

IBM AIX>=7.2.5<=7.2.5.212

IBM AIX>=7.3.2<=7.3.2.5

IBM AIX>=7.3.3<=7.3.3.2

IBM AIX>=7.3.4<=7.3.4.1

IBM VIOS>=4.1.0<4.1.0.50

IBM VIOS>=4.1.1.0<4.1.1.30

IBM VIOS>=4.1.2.0<4.1.2.20

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM AIX 7.2 TL05 to a version that resolves this vulnerability.
Fixed in SP13Patch SP13key_w_apar
Upgrade
Upgrade IBM AIX 7.3 TL04 to a version that resolves this vulnerability.
Fixed in SP2Patch IJ5956608/14/2026
Upgrade
Upgrade IBM AIX 7.3 TL03 to a version that resolves this vulnerability.
Fixed in SP3Patch IJ5956508/14/2026
Upgrade
Upgrade IBM AIX 7.3 TL02 to a version that resolves this vulnerability.
Fixed in SP5Patch IJ5956408/14/2026
Upgrade
Upgrade IBM PowerVM VIOS 4.1.0 to a version that resolves this vulnerability.
Fixed in 4.1.0.50Patch IJ5956508/14/2026
Upgrade
Upgrade IBM PowerVM VIOS 4.1.1 to a version that resolves this vulnerability.
Fixed in 4.1.1.30Patch IJ5956408/14/2026
Upgrade
Upgrade IBM PowerVM VIOS 4.1.2 to a version that resolves this vulnerability.
Fixed in 4.1.2.20Patch IJ5956308/14/2026
Compensating control
When applying VIOS/AIX patches using nimsh secure, follow the stated nimsh secure post-patching steps because the protocol between master and client is updated to be more secure (per IBM article guidance).
Compensating control
On AIX, use Live Update to avoid a reboot if applicable (per IBM guidance).
Operational
Reboot the LPAR after applying the SP/FP update to complete the remediation (AIX/VIOS).
Operational
For VIOS 4.1.0 and VIOS 4.1.1: after applying the 4.1.0.50 or 4.1.1.30 FPs, perform the additional required steps to migrate to the latest Postgres15 (per IBM post-update instructions).

Event History

Aug 15, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Aug 19, 2026

CVE Published

via MITRE·07:31 PM

Data Sourced

via MITRE·07:31 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:17 PM

RemedyDescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-7283858

Frequently Asked Questions

Which IBM environments should be assessed for exposure?

Assess systems running IBM AIX and IBM PowerVM VIOS.

Does exploitation require an attacker to have local access?

No. The issue is described as remotely exploitable.

What could a successful attacker do?

A successful exploit could allow execution of arbitrary operating-system commands.

CVE-2026-16842: Vulnerabilities in IBM AIX and PowerVM VIOS

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Which IBM environments should be assessed for exposure?

Does exploitation require an attacker to have local access?

What could a successful attacker do?

Company

Resources

Contact