IBM AIX CVE-2026-16914

Exploitation requires local access to the target IBM AIX 7.2/7.3 or PowerVM VIOS 4.1 system with high privileges (PR:H per the CVSS vector), meaning the attacker must already hold root-equivalent or administrator-level credentials. The attack vector is strictly local (AV:L), ruling out remote or network-based exploitation. No user interaction is required once privileged local access is obtained. The primary limiting factor is the PR:H requirement: an attacker without pre-existing high-privilege local access cannot exploit this vulnerability. There is no indication that a non-default configuration or special feature flag is required beyond possessing high-privilege local access on a vulnerable OS version.

The CVSS base score of 6.7 reflects the constrained exploitation conditions: AV:L limits the attack to a locally present adversary, and PR:H demands that the attacker already hold high system privileges - effectively administrator or root-equivalent access on AIX or VIOS. The full CIA triad impact (C:H/I:H/A:H) reflects that successful exploitation yields arbitrary code execution, potentially including kernel-level control. Despite the high impact potential, no EPSS data was provided, no CISA KEV listing exists, and no public proof-of-concept has been identified. The real-world threat is therefore narrow: this is a privilege-escalation or post-compromise persistence mechanism, not an initial-access vector. The PR:H prerequisite means an attacker must already have meaningful system control, significantly limiting exposure. IBM Power/AIX environments are typically air-gapped or tightly access-controlled enterprise infrastructures, further reducing realistic attacker reach. This is a genuine concern for insider-threat or post-breach scenarios, not opportunistic internet-facing attacks.

A local administrator or root-equivalent user on an IBM AIX or PowerVM VIOS system triggers the out-of-bounds write vulnerability in a privileged binary or kernel component, corrupting adjacent memory in a controlled manner. This allows the attacker to redirect execution flow and run arbitrary code with the privileges of the affected component, potentially achieving persistent kernel-level access or compromising VIOS to affect hosted LPARs. No public proof-of-concept exists at time of analysis, requiring an attacker to independently develop working exploit code.