CVE-2026-16980: Vulnerabilities in IBM AIX and PowerVM VIOS

Q: Which systems should be prioritized for review?

Systems running IBM AIX or IBM PowerVM VIOS should be reviewed. The provided information does not identify affected versions or configurations.

Q: What level of access does an attacker need?

The issue is described as exploitable by a local attacker. The available data does not indicate that remote access alone is sufficient.

Published Aug 15, 2026

Updated

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to improper validation of symbolic links.

Affected Software

10 affected components

IBM AIX<=7.2

IBM AIX<=7.3

IBM PowerVM VIOS<=4.1

IBM VIOS>=4.1.0<4.1.0.50

IBM VIOS>=4.1.1.0<4.1.1.30

IBM VIOS>=4.1.2.0<4.1.2.20

IBM AIX>=7.2.5<=7.2.5.212

IBM AIX>=7.3.2<=7.3.2.5

IBM AIX>=7.3.3<=7.3.3.2

IBM AIX>=7.3.4<=7.3.4.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM PowerVM VIOS to a version that resolves this vulnerability.
Fixed in 4.1.0.50Patch SPKEY4.1.0IJ5956508/14/20264.1.0.50key_w_apar
Upgrade
Upgrade IBM PowerVM VIOS to a version that resolves this vulnerability.
Fixed in 4.1.1.30
Upgrade
Upgrade IBM PowerVM VIOS to a version that resolves this vulnerability.
Fixed in 4.1.2.20
Upgrade
Upgrade IBM AIX to a version that resolves this vulnerability.
Patch SPKEY7.2.5IJ59566
Operational
Perform an LPAR reboot to complete the SP/FP update.

Event History

Aug 15, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Aug 20, 2026

CVE Published

via MITRE·09:46 PM

Data Sourced

via MITRE·09:46 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

RemedyDescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-7283858

Frequently Asked Questions

Which systems should be prioritized for review?

Systems running IBM AIX or IBM PowerVM VIOS should be reviewed. The provided information does not identify affected versions or configurations.

What level of access does an attacker need?

The issue is described as exploitable by a local attacker. The available data does not indicate that remote access alone is sufficient.

CVE-2026-16980: Vulnerabilities in IBM AIX and PowerVM VIOS

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Which systems should be prioritized for review?

What level of access does an attacker need?

Company

Resources

Contact