IBM AIX CVE-2026-16923

The attacker must have an existing local session or account on the affected IBM AIX or PowerVM VIOS system with at least low-privilege access (PR:L per CVSS vector). No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning no special environmental conditions or race conditions must be triggered once local access is established. The CVE description does not specify a particular service, feature flag, or non-default configuration as a prerequisite - the flaw appears to exist in core privilege management logic applicable to standard deployments. Exploitation is limited to: local access to the system (AV:L), meaning remote unauthenticated exploitation is not possible; physical or remote shell/SSH session with at least a standard unprivileged OS account is required. Scope is unchanged (S:U), so impact is contained to the compromised host or VIOS partition rather than automatically spreading to adjacent systems.

The CVSS base score of 7.8 (High) is driven by total C/H/I/A impact despite the local-only attack vector, reflecting the severity of a full privilege escalation to root or equivalent. However, multiple signals substantially moderate real-world risk: EPSS is 0.11% at the 2nd percentile, meaning very few similar vulnerabilities have seen active exploitation within 30 days of disclosure; SSVC exploitation status is 'none'; and the automatable flag is 'no', confirming this cannot be trivially scripted at scale against exposed systems. The attack vector (AV:L) requires an attacker to already have local access - this limits exposure primarily to insider threats, post-exploitation lateral movement, or compromised service accounts. The SSVC technical impact of 'total' aligns with the CVSS C:H/I:H/A:H triad, meaning successful exploitation fully compromises the host or VIOS partition. Net assessment: medium operational priority for environments running IBM AIX or PowerVM - patch during the next maintenance window rather than emergency, unless local threat actors or shared-LPAR multi-tenant environments are a concern.

An attacker who has already obtained a low-privilege local account on an IBM AIX 7.2/7.3 or PowerVM VIOS 4.1 system - through credential theft, a phishing-delivered shell, or lateral movement from another compromised host - exploits the improper privilege management flaw to escalate to root or a privileged group. No public exploit has been identified at time of analysis, but the low attack complexity (AC:L) suggests the privilege escalation path, once identified, does not require complex chaining or race conditions. On a VIOS partition, root-level compromise could extend attacker control over all client LPARs sharing that I/O server.