CVE-2026-16882: Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM PowerVM VIOS 4.1.0to a version that resolves this vulnerability.Fixed in 4.1.0.50Patch IJ5956508 - Upgrade
Upgrade
IBM PowerVM VIOS 4.1.1to a version that resolves this vulnerability.Fixed in 4.1.1.30Patch IJ5956408 - Upgrade
Upgrade
IBM PowerVM VIOS 4.1.2to a version that resolves this vulnerability.Fixed in 4.1.2.20Patch IJ5956308 - Compensating control
For VIOS 4.1.0 and VIOS 4.1.1, after applying the 4.1.0.50 or 4.1.1.30 FPs, perform the additional steps required to migrate to the latest Postgres15.
- Operational
After applying the AIX SP/FP update (service pack/fix pack), reboot the LPAR to complete the SP/FP update.
Event History
Frequently Asked Questions
Which IBM products are identified as affected?
The affected products listed are IBM AIX and IBM PowerVM VIOS.
What level of access does an attacker need?
The issue is described as remotely exploitable. The provided information does not specify whether authentication, network reachability to a particular service, or other prerequisites are required.
What is the potential impact of successful exploitation?
A remote attacker could execute arbitrary operating-system commands because special elements used in an OS command are not properly neutralized.