CVE-2026-16901: Vulnerabilities in IBM AIX and PowerVM VIOS

Published Aug 15, 2026

Updated

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.

Affected Software

10 affected components

IBM AIX<=7.2

IBM AIX<=7.3

IBM PowerVM VIOS<=4.1

IBM VIOS>=4.1.0<4.1.0.50

IBM VIOS>=4.1.1.0<4.1.1.30

IBM VIOS>=4.1.2.0<4.1.2.20

IBM AIX>=7.2.5<=7.2.5.212

IBM AIX>=7.3.2<=7.3.2.5

IBM AIX>=7.3.3<=7.3.3.2

IBM AIX>=7.3.4<=7.3.4.1

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM PowerVM VIOS 4.1.0 to a version that resolves this vulnerability.
Fixed in 4.1.0.50Patch key_w_apar
Upgrade
Upgrade IBM PowerVM VIOS 4.1.1 to a version that resolves this vulnerability.
Fixed in 4.1.1.30Patch key_w_apar
Upgrade
Upgrade IBM PowerVM VIOS 4.1.2 to a version that resolves this vulnerability.
Fixed in 4.1.2.20Patch key_w_apar
Upgrade
Upgrade IBM AIX 7.2 to a version that resolves this vulnerability.
Patch IJ5956608/14/2026
Upgrade
Upgrade IBM AIX 7.3 to a version that resolves this vulnerability.
Patch IJ5956508/14/2026
Upgrade
Upgrade IBM AIX 7.3 to a version that resolves this vulnerability.
Patch IJ5956408/14/2026
Upgrade
Upgrade IBM AIX 7.3 to a version that resolves this vulnerability.
Patch IJ59563
Operational
An LPAR reboot is required to complete the SP/FP update.
Operational
For VIOS 4.1.0 and VIOS 4.1.1, after applying the 4.1.0.50 or 4.1.1.30 FPs, perform additional steps to migrate to the latest Postgres15.

Aug 15, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Aug 19, 2026

CVE Published

via MITRE·07:54 PM

Data Sourced

via MITRE·07:54 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:17 PM

RemedyDescriptionSeverityWeaknessAffected Software

This vulnerability appears in the following advisories.