CVE-2026-16903: Vulnerabilities in IBM AIX and PowerVM VIOS

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Upgrade

   Upgrade IBM PowerVM VIOS 4.1.0 to a version that resolves this vulnerability.

   Fixed in 4.1.0.50
2. Upgrade

   Upgrade IBM PowerVM VIOS 4.1.1 to a version that resolves this vulnerability.

   Fixed in 4.1.1.30Patch key_w_apar4.1.1
3. Upgrade

   Upgrade IBM PowerVM VIOS 4.1.2 to a version that resolves this vulnerability.

   Fixed in 4.1.2.20Patch key_w_apar4.1.2
4. Upgrade

   Upgrade IBM AIX 7.2 to a version that resolves this vulnerability.

   Fixed in SP13Patch IJ5956608
5. Upgrade

   Upgrade IBM AIX 7.3 TL04 to a version that resolves this vulnerability.

   Fixed in SP2Patch IJ5956508
6. Upgrade

   Upgrade IBM AIX 7.3 TL03 to a version that resolves this vulnerability.

   Fixed in SP3Patch IJ5956408
7. Upgrade

   Upgrade IBM AIX 7.3 TL02 to a version that resolves this vulnerability.

   Fixed in SP5Patch IJ59563
8. Compensating control

   If updating via nimsh secure, take the special steps mentioned in the article because the protocol between the nimsh master and client is updated to be more secure.

9. Compensating control

   For AIX, use Live Update to avoid a reboot when applying the SP/FP remediation levels.

10. Operational

    An LPAR reboot is required to complete the SP/FP update.

11. Operational

    For VIOS 4.1.0 and VIOS 4.1.1, after applying the 4.1.0.50 or 4.1.1.30 FPs, perform additional steps to migrate to the latest Postgres15.

Event History

Parent advisories

This vulnerability appears in the following advisories.

• IBM-7283858