CVE-2026-16932: Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper validation of the ODMDIR environment variable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.2.20Patch IJ5956308 - Upgrade
Upgrade
IBM PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.1.30Patch IJ5956408 - Upgrade
Upgrade
IBM PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.0.50Patch IJ5956508 - Upgrade
Upgrade
IBM AIXto a version that resolves this vulnerability.Patch IJ5956508 - Upgrade
Upgrade
IBM AIXto a version that resolves this vulnerability.Patch IJ5956608 - Upgrade
Upgrade
IBM AIXto a version that resolves this vulnerability.Patch IJ5956408 - Upgrade
Upgrade
IBM AIXto a version that resolves this vulnerability.Patch IJ59563 - Operational
For AIX SP/FP updates, perform an LPAR reboot to complete the SP/FP update.
- Operational
For VIOS 4.1.0 and VIOS 4.1.1, perform additional steps to migrate to the latest Postgres15 after applying the 4.1.0.50 or 4.1.1.30 FPs.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running IBM AIX or IBM PowerVM VIOS are in scope. Exploitation requires a local attacker.
What does an attacker need to control to exploit it?
The attacker needs to be able to influence the ODMDIR environment variable. Improper validation of that variable could enable execution of arbitrary commands.