CVE-2026-16866: Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.1.0.50 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.1.1.30 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.1.2.20 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch IJ5956508 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch IJ5956408 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch IJ5956308 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SP13 - Compensating control
For AIX, apply the remediation SP/FP using nimsh secure only after taking the special steps required because the protocol between master and client is updated to be more secure.
- Operational
Reboot the LPAR to complete the SP/FP update.
Event History
Frequently Asked Questions
Which systems should be included in the exposure review?
Review IBM AIX and IBM PowerVM VIOS systems. The provided data does not identify affected versions or configurations.