CVE-2026-16925: Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to achieve privilege escalation due to improper authorization.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.0.50 - Upgrade
Upgrade
IBM PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.1.30Patch key_w_apar4.1.1 - Upgrade
Upgrade
IBM PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.2.20Patch key_w_apar4.1.2 - Compensating control
When applying AIX/VIOS patches using nimsh secure, take the special steps noted in the article because the protocol between master and client is updated to be more secure.
- Operational
For the AIX Service Pack / VIOS Fix Pack remediation update, perform an LPAR reboot to complete the SP/FP update.
- Operational
For VIOS 4.1.0 and VIOS 4.1.1, after applying the 4.1.0.50 or 4.1.1.30 FPs, migrate to the latest Postgres15 as required by the post-update instructions.
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The issue requires local attacker access. Successful exploitation could allow privilege escalation due to improper authorization.
Which IBM products should be assessed for exposure?
Assess IBM AIX and IBM PowerVM VIOS systems. No affected versions or configuration conditions are provided in the available data.