IBM AIX CVE-2026-16922

Exploitation requires an authenticated local session on the affected IBM AIX 7.2/7.3 or PowerVM VIOS 4.1 system with at least low-privilege credentials (CVSS PR:L). The CVSS AC:H metric indicates the attack is complexity-dependent: the attacker must reliably win a timing race between a privileged process's check and use of a resource, which is sensitive to system load and scheduler behavior and is not reliably automatable. No network exposure is required; the attack is strictly local (AV:L). Factors that limit exploitation include the need for an existing local account, the non-trivial timing requirement, and the absence of any known public exploit code. Remote-only or anonymous attackers cannot trigger this vulnerability without first obtaining local access through a separate vulnerability.

The CVSS 7.0 base score is moderated heavily by AC:H, meaning exploitation is not reliable or trivially automated - the attacker must win a precise timing race, which typically requires significant tuning to the target system's scheduler and load profile. PR:L confirms that a standard unprivileged local account (not root, not admin) is sufficient to attempt the attack, which is a meaningful lowering of the bar in multi-tenant or shared AIX environments. The scope is unchanged (S:U), so impact is bounded to the compromised system. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified from available data. The vulnerability is absent from the CISA KEV catalog and no public proof-of-concept has been identified, suggesting exploitation remains theoretical or confined to internal research at this time. In aggregate, this is a real but non-trivial local privilege escalation: environments where untrusted users hold local AIX accounts - shared LPAR environments, developer systems, or VIOS management hosts - carry the greatest realistic exposure and should prioritize patching, while air-gapped or single-tenant Power systems face materially lower urgency.

An attacker with a low-privileged local AIX account identifies a privileged setuid binary or system daemon that reads a file path without holding an exclusive lock between the access check and the open call. By repeatedly substituting a symlink pointing to a sensitive target (such as /etc/passwd or a privileged executable) during the race window, the attacker causes the privileged process to operate on the substituted file, ultimately achieving arbitrary code execution in the context of the elevated process. No public proof-of-concept has been identified, so this scenario currently requires attacker-developed tooling.