CVE-2026-16917: Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an integer overflow.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.0.50Patch key_w_apar7.3.2IJ5956508/14/2026 - Upgrade
Upgrade
PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.1.30Patch key_w_apar7.3.3IJ5956408/14/2026 - Upgrade
Upgrade
PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.2.20Patch key_w_apar7.3.4IJ59563 - Configuration
On AIX, use Live Update to avoid a reboot (an LPAR reboot is required to complete the SP/FP update otherwise).
AIX Live Update reboot_requirement = avoid_reboot - Compensating control
If using nimsh secure to apply these AIX/VIOS SP/FP remediations, follow the article guidance because additional steps are required since the protocol between master and client is updated to be more secure.
- Operational
Perform an LPAR reboot to complete the SP/FP update.
- Operational
For VIOS 4.1.0 and VIOS 4.1.1, after applying the 4.1.1.30 or 4.1.0.50 FPs, run the additional post-update steps to migrate to the latest Postgres15.
Event History
Frequently Asked Questions
Which products are identified as affected?
The listed products are IBM AIX and IBM PowerVM VIOS.
Does an attacker need local access to exploit this issue?
No. The issue is described as exploitable by a remote attacker, with potential for arbitrary code execution.