EUVD-2026-62832
GHSA-59pj-mhpc-mwm2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed AIX/VIOS network service
-
DeliverySend crafted oversized request
-
ExploitOverflow fixed-size stack buffer
-
ExecutionOverwrite saved return address
-
PersistExecute arbitrary shellcode
-
ImpactFull compromise of AIX/VIOS host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions - remote unauthenticated exploitation against IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 with no user interaction required. The practical limiting factors are: the attacker must have network reachability to the specific vulnerable service (the exact daemon/port is not named in the advisory, so the service may not be exposed in all deployments), and the target must be running the affected OS levels on IBM Power hardware, which is a specialized rather than ubiquitous platform. Hosts whose management/service interfaces are firewalled off from untrusted networks are not remotely reachable and are therefore not exploitable over the network. |
| Impact | The signals are mostly aligned toward high priority but incomplete. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 Critical) indicates a network-reachable, low-complexity, unauthenticated flaw with total confidentiality, integrity, and availability impact - a near worst-case profile. However, there is no EPSS score, no SSVC decision data, no KEV listing, and no evidence of public exploit code in the provided intelligence, so real-world exploitation probability cannot be quantified from the data at hand. The absence of a named vulnerable service and the fact that AIX/VIOS run on relatively specialized Power hardware temper the likelihood of mass, opportunistic exploitation compared to a commodity Linux/Windows daemon. Net: treat as a genuine critical-severity patch priority for Power-based environments, while noting exploitation-likelihood signals (EPSS/KEV/POC) are simply missing rather than confirmed low. |
| Exploit ScenarioDerived | A remote attacker with network access to an exposed AIX 7.3 host or VIOS 4.1 management interface sends a crafted request to the vulnerable network service, overflowing a fixed-size stack buffer and overwriting the saved return address. This redirects execution into attacker-supplied shellcode, giving the attacker arbitrary code execution on the host without needing any credentials or user interaction. No public proof-of-concept is currently identified, so an attacker would need to develop the exploit independently. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Remote code execution in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 stems from a stack-based buffer overflow that a remote attacker can trigger without authentication, per IBM PSIRT (CVE-2026-16913). With a CVSS 3.1 base of 9.8 (AV:N/AC:L/PR:N/UI:N) and full CIA impact, successful exploitation yields arbitrary code execution on the affected UNIX operating system or virtualization I/O server. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the network-reachable, unauthenticated profile makes this a high-priority patch.
RemediationAI
Apply the IBM-provided fix by following the vendor advisory at https://www.ibm.com/support/pages/node/7283858, which enumerates the specific APAR/ifix or technology-level updates for AIX 7.2, AIX 7.3, and VIOS 4.1 - the input data does not include an exact fixed version string, so consult that advisory for the precise iFix/service pack rather than an invented version number (Patch available per vendor advisory). Until the fix is installed, reduce exposure by restricting network reachability of the affected host: place AIX/VIOS management and service interfaces behind firewall ACLs so only trusted administrative subnets can reach them, disable any unneeded network-facing services or daemons on the LPAR/VIOS, and segment VIOS management networks from general user traffic. These network-restriction controls can disrupt legitimate remote administration and automated management tooling, so validate ACL changes against operational access requirements before enforcing them.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM AIX is IBM's proprietary POSIX/UNIX operating system for Power Systems hardware, and PowerVM VIOS (Virtual I/O Server) is the specialized AIX-derived appliance that virtualizes storage and network I/O for LPARs on Power servers. The root cause is CWE-787 (Out-of-bounds Write), specifically a stack buffer overflow: attacker-controlled input is copied into a fixed-size stack buffer without adequate bounds checking, allowing corruption of the return address and adjacent stack data. Because VIOS shares the AIX code base, the same vulnerable component appears in both products. The specific network-facing service or daemon that parses the malicious input is not named in the available advisory data, which is required to pinpoint the exact affected binary.
Know when Aix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states remote arbitrary code execution via stack buffer overflow with no stated auth or interaction, so AV:N/AC:L/PR:N/UI:N and full C/I/A impact.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow.
Executive ViewAI
A critical remote code execution vulnerability (CVSS 9.8) in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows unauthenticated attackers to execute arbitrary code over the network without requiring credentials or user interaction. Organizations operating these AIX platforms face immediate risk of system compromise, unauthorized access, and potential data exfiltration across their virtualized infrastructure. While no public exploit has been identified at time of analysis, the network-reachable, unauthenticated attack vector makes this a severe organizational risk requiring urgent defensive actions.
Implement network-based segmentation and strict firewall rules to restrict remote access to affected systems; deploy network intrusion detection and prevention systems to monitor and block exploitation attempts; enable comprehensive audit and system logging on affected AIX and PowerVM systems; isolate affected systems behind bastion hosts or administrative jump servers; and maintain continuous 24/7 security operations monitoring for indicators of compromise. No vendor-released patch identified at time of analysis; monitor IBM PSIRT continuously for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Exploit-DB