CVE-2026-19446: Vulnerabilities in IBM AIX and PowerVM VIOS

Q: What access does an attacker need to trigger the denial of service?

An attacker does not need authentication. They need network reachability to an RPC service that can receive the crafted UDP packet.

Q: What is the operational impact if exploitation succeeds?

Successful exploitation causes complete system unavailability. Recovery requires restarting the affected LPAR.

Q: Which products should be assessed for exposure?

Assess IBM AIX and IBM PowerVM VIOS systems, particularly LPARs with reachable RPC services exposed to networks accessible by untrusted remote users.

Published Aug 15, 2026

Updated

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 allows a remote unauthenticated attacker can send a crafted UDP packet to a reachable RPC service, resulting in complete system unavailability and requiring an LPAR restart.

Affected Software

10 affected components

IBM AIX<=7.2

IBM AIX<=7.3

IBM PowerVM VIOS<=4.1

IBM VIOS>=4.1.0<4.1.0.50

IBM VIOS>=4.1.1.0<4.1.1.30

IBM VIOS>=4.1.2.0<4.1.2.20

IBM AIX>=7.2.5<=7.2.5.212

IBM AIX>=7.3.2<=7.3.2.5

IBM AIX>=7.3.3<=7.3.3.2

IBM AIX>=7.3.4<=7.3.4.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM AIX 7.2/7.3 to a version that resolves this vulnerability.
Patch SPKEY7.2.5
Upgrade
Upgrade IBM AIX 7.3 TL02 to a version that resolves this vulnerability.
Patch IJ5956408
Upgrade
Upgrade IBM AIX 7.3 TL03 to a version that resolves this vulnerability.
Patch IJ5956508
Upgrade
Upgrade IBM AIX 7.3 TL04 to a version that resolves this vulnerability.
Patch IJ5956608
Upgrade
Upgrade IBM PowerVM VIOS 4.1.0 to a version that resolves this vulnerability.
Fixed in 4.1.0.50Patch IJ5956508
Upgrade
Upgrade IBM PowerVM VIOS 4.1.1 to a version that resolves this vulnerability.
Fixed in 4.1.1.30Patch IJ5956408
Upgrade
Upgrade IBM PowerVM VIOS 4.1.2 to a version that resolves this vulnerability.
Fixed in 4.1.2.20Patch IJ5956308
Compensating control
For VIOS 4.1.0 and VIOS 4.1.1, perform the additional steps required to migrate to the latest Postgres15 after applying the 4.1.0.50 or 4.1.1.30 FPs.
Compensating control
If applying these patches using nimsh secure, follow the special steps required because the protocol between master and client is updated to be more secure.
Compensating control
On AIX, Live Update can be used to avoid a reboot.
Operational
An LPAR reboot is required to complete the SP/FP update.

Event History

Aug 15, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Aug 20, 2026

CVE Published

via MITRE·10:04 PM

Data Sourced

via MITRE·10:04 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

RemedyDescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-7283858

Frequently Asked Questions

What access does an attacker need to trigger the denial of service?

An attacker does not need authentication. They need network reachability to an RPC service that can receive the crafted UDP packet.

What is the operational impact if exploitation succeeds?

Successful exploitation causes complete system unavailability. Recovery requires restarting the affected LPAR.

Which products should be assessed for exposure?

Assess IBM AIX and IBM PowerVM VIOS systems, particularly LPARs with reachable RPC services exposed to networks accessible by untrusted remote users.

CVE-2026-19446: Vulnerabilities in IBM AIX and PowerVM VIOS

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What access does an attacker need to trigger the denial of service?

What is the operational impact if exploitation succeeds?

Which products should be assessed for exposure?

Company

Resources

Contact