CVE-2026-17141: Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM PowerVM VIOS 4.1.0to a version that resolves this vulnerability.Fixed in 4.1.0.50Patch IJ5956508/14/2026 - Upgrade
Upgrade
IBM PowerVM VIOS 4.1.1to a version that resolves this vulnerability.Fixed in 4.1.1.30Patch IJ5956408/14/2026 - Upgrade
Upgrade
IBM PowerVM VIOS 4.1.2to a version that resolves this vulnerability.Fixed in 4.1.2.20Patch IJ5956308/14/2026 - Compensating control
If applying these patches using nimsh secure, use the special steps required because the protocol between the nimsh master and client is updated to be more secure.
- Operational
After applying the AIX SP/FP update, reboot the LPAR to complete the update.
- Operational
For VIOS 4.1.0 and VIOS 4.1.1, migrate to the latest Postgres15 after applying the 4.1.0.50 or 4.1.1.30 FPs.
Event History
Frequently Asked Questions
Which systems should be checked during triage?
The affected software list includes IBM AIX and IBM PowerVM VIOS.
What attacker access is documented as necessary?
The available information identifies the attacker as remote. It does not specify whether authentication, a particular network service, or a non-default configuration is required.
Are patch versions or temporary mitigations provided?
The supplied information does not include fixed versions, patch identifiers, or workarounds. The IBM support reference is the only remediation-related resource provided.