IBM AIX CVE-2026-16927

Exploitation requires an existing local authenticated session on the target IBM AIX or PowerVM VIOS host with at least low-privilege OS access (PR:L per CVSS). The attacker must be able to run persistent or looping processes to win the timing window inherent to a TOCTOU race, which the CVSS AC:H metric reflects - reliable exploitation is not guaranteed and typically requires multiple attempts or favorable scheduling conditions. The flaw does not affect remote or unauthenticated attackers: network-level exposure does not apply (AV:L). Exploitation is further constrained by the SSVC finding that it is not automatable at scale. Environments where untrusted or semi-trusted users hold local accounts on AIX/VIOS nodes face the highest realistic risk. Hardened environments with no interactive non-administrative local accounts face negligible residual risk without patching.

The CVSS 7.0 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures a constrained but high-impact scenario: the attacker must already be authenticated locally with at least low-level OS privileges, and must successfully time a race window, which AC:H reflects. Full CIA impact (H/H/H) is consistent with root acquisition. EPSS at 0.12% places this in the bottom 2% of exploitation likelihood across all CVEs, signalling that automated or opportunistic exploitation is highly unlikely. SSVC corroborates this: 'Automatable: no' confirms that the race condition cannot be reliably scripted at scale, while 'Technical Impact: total' confirms the worst-case outcome if exploitation succeeds. No CISA KEV listing and no known POC further reduce urgency. Contrast with a hypothetical network-accessible TOCTOU: this flaw demands local foothold first, substantially limiting the attacker population. Overall this is a medium-priority patch - serious for environments with untrusted local users on AIX or VIOS nodes, but not an emergency for externally hardened systems.

An attacker with a low-privileged local shell account on an IBM AIX 7.3 system identifies a SUID binary or privileged system call that evaluates a file or symlink in a non-atomic check-then-use sequence. They run a race loop that rapidly swaps a controlled symlink target in the gap between the privilege check and the file operation, redirecting the action to a sensitive system file such as /etc/passwd or a root-owned executable. On a successful race win, the attacker achieves root-level code execution or credential manipulation. No public POC is known, meaning exploitation requires custom tooling and local access.