EUVD-2026-62749
GHSA-82q4-49mx-8527
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Remote unauthenticated access (AV:N, PR:N) with no interaction; high integrity impact from DNS/routing manipulation; no confidentiality or significant availability loss.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to manipulate network traffic and DNS configuration due to improper authentication.
AnalysisAI
Remote unauthenticated manipulation of network traffic and DNS configuration is possible in IBM AIX 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1, due to improper authentication controls (CWE-287). The CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no user interaction, and no special network positioning - making this accessible to any remote attacker with TCP connectivity to an affected system. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed, but the low attack complexity and high integrity impact make this a meaningful priority for IBM Power Systems environments.
Technical ContextAI
IBM AIX is a certified UNIX operating system running on IBM Power Systems hardware, widely deployed in enterprise and financial sector environments. IBM PowerVM VIOS (Virtual I/O Server) is a specialized AIX partition that provides virtualized I/O resources to other logical partitions (LPARs) on the same Power Systems host. The affected versions per CPE data are cpe:2.3:a:ibm:aix (covering 7.2 and 7.3) and cpe:2.3:a:ibm:powervm_vios (covering 4.1). CWE-287 (Improper Authentication) indicates the root cause is a failure to properly verify the identity of clients making requests to a network-facing service or daemon - specifically one responsible for DNS resolution or network traffic handling. In the AIX and VIOS context, this likely involves a system daemon or API exposed over the network that processes DNS configuration or routing changes without adequately validating the requestor's identity, allowing an unauthenticated caller to issue privileged configuration commands.
RemediationAI
A vendor-released patch is available from IBM. Administrators should consult the IBM support advisory at https://www.ibm.com/support/pages/node/7283858 for the specific fix package, interim fix (ifix), or Technology Level (TL) addressing CVE-2026-16857 on AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1. The exact patched version is not independently confirmed from available data - verify the precise build level in the advisory before deployment. As a compensating control pending patch application, restrict network access to AIX and VIOS management interfaces (including DNS configuration endpoints) using host-based firewall rules (IPFilter on AIX) or upstream network ACLs to limit exposure to trusted management subnets only. Additionally, review and harden AIX network daemon configurations to ensure no unauthenticated management interfaces are exposed on untrusted network segments. Note that firewall-based restriction reduces exploitability but does not eliminate the underlying authentication flaw.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today