EUVD-2026-62828
GHSA-v8j7-x5rv-cr35
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEstablish adjacent network position
-
DeliverySend crafted malformed network packet
-
ExploitTrigger out-of-bounds write in AIX/VIOS service handler
-
ExecutionCorrupt memory control structures
-
ImpactExecute arbitrary code as service user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Adjacent network access is required - the attacker must be on the same local network segment, VLAN, or directly routable subnet as the target AIX or VIOS system (AV:A per CVSS). No authentication is required (PR:N) and no user interaction is needed (UI:N). The specific network service or daemon containing the vulnerability is not named in the available data; defenders should consult the IBM advisory at https://www.ibm.com/support/pages/node/7283858 to identify which service to isolate. The primary limiting factor is network adjacency - systems that are not reachable from untrusted adjacent segments are substantially protected. Internet-facing exploitation is not indicated by the adjacent attack vector. |
| Impact | The official CVSS 3.1 score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a high-severity flaw constrained primarily by the adjacent-network attack vector rather than full internet exposure. This significantly limits the attack surface compared to an AV:N vulnerability - an attacker must be on the same network segment, VLAN, or directly connected subnet to reach the vulnerable service. Low complexity and no required privileges or user interaction mean that once adjacency is established, exploitation is straightforward. EPSS data was not provided in the input, so probabilistic exploitation likelihood cannot be quantified. No KEV listing is present and no public exploit code has been identified, suggesting no confirmed active exploitation at time of analysis. The scope of affected products is notable: PowerVM VIOS underpins IBM POWER virtualization stacks, meaning a compromised VIOS host could have downstream implications for guest logical partitions beyond the S:U (unchanged scope) recorded in the CVSS vector - defenders should factor this into their risk calculus even though the official vector does not reflect a scope change. |
| Exploit ScenarioDerived | An attacker with access to the same network segment as an IBM AIX or VIOS system - for example, an insider, a compromised host on the same VLAN, or an attacker who has pivoted into the internal network - sends a specially crafted network packet to the vulnerable service. The malformed input triggers an out-of-bounds memory write in the network handler, corrupting control-flow data and redirecting execution to attacker-controlled code. No authentication or user interaction is required, so exploitation can be scripted and repeated until successful. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Out-of-bounds write in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables an unauthenticated attacker positioned on an adjacent network segment to execute arbitrary code with full confidentiality, integrity, and availability impact. The CWE-787 class flaw requires no privileges and no user interaction, lowering the exploitation bar substantially once network adjacency is achieved. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of zero-prerequisite exploitation and complete system compromise warrants urgent patching in affected enterprise environments.
RemediationAI
Consult and apply the fix documented in the IBM security advisory at https://www.ibm.com/support/pages/node/7283858. No specific patched version number was included in the input data, so the exact fix level (APARs, technology level, or service pack) must be obtained directly from that advisory. As an interim compensating control, restrict network adjacency to the vulnerable AIX and VIOS systems by enforcing strict VLAN segmentation and firewall rules to limit which hosts can reach the affected network services; this reduces exposure without eliminating the vulnerability. Disabling or restricting access to non-essential AIX network daemons (e.g., rpcbind, NFS, or other services exposed over the local network) may reduce attack surface but could affect legitimate operations and should be tested before deployment. IBM VIOS environments should also ensure management interfaces are isolated to dedicated management VLANs inaccessible from general-purpose workloads.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM AIX is a Unix-based operating system running on IBM POWER architecture hardware; IBM PowerVM VIOS (Virtual I/O Server) is middleware that runs atop IBM POWER hardware to provide virtualized I/O resources to guest logical partitions. CWE-787 (Out-of-Bounds Write) indicates that a component - most likely a network-facing service or protocol handler in AIX or VIOS - fails to properly validate write boundaries, allowing an attacker to corrupt adjacent memory. This class of flaw typically arises in C/C++ code handling network-supplied data without sufficient bounds checking. The adjacent-network attack vector (AV:A per CVSS) implies the vulnerable service is reachable over a local network segment, VLAN, or similar layer-2-adjacent path rather than the open internet, consistent with AIX network daemon or VIOS management protocol exposure.
Know when Aix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent-network vector confirmed by description; no privileges or interaction required; full RCE yields high CIA impact with unchanged scope.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.
Executive ViewAI
A critical remote code execution vulnerability (CVE-2026-16901) affects IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 systems, allowing unauthenticated attackers with adjacent network access to gain complete system control without user action. No vendor-released patch has been identified at time of analysis, exposing organizations to total operational disruption, data compromise, and lateral spread within connected infrastructure. Immediate network isolation and access restrictions are the only defenses pending patch availability.
Network segmentation to isolate vulnerable systems from untrusted adjacent networks; strict firewall rules limiting inbound connections to only essential infrastructure; network-based intrusion detection and prevention focusing on exploitation signatures; enhanced logging and monitoring of all network activity to vulnerable systems; maintenance of isolated backup infrastructure outside compromised network zones; and development of rapid isolation and incident response procedures for suspected exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Exploit-DB