IBM AIX CVE-2026-16932

Exploitation requires a local user account with at least standard (low) privileges - confirmed by CVSS PR:L. The attacker must be able to set the ODMDIR environment variable in a context where a privileged process inherits it, either via direct interactive shell access or through a mechanism that propagates environment variables into privileged daemons or setuid binaries. CVSS AV:L confirms this is not remotely exploitable without a prior local foothold. Limiting factors: no network attack vector (remote-only adversaries cannot exploit without first compromising a local account), requires at least one authenticated local session, and exploitation depends on which specific ODM-consuming privileged utilities are exposed to user-controlled environments. No special non-default configuration is required - default AIX installations with ordinary user accounts are susceptible wherever ODMDIR is not explicitly locked down.

The CVSS 8.8 score accurately reflects a serious local privilege escalation: AV:L confirms exploitation requires local access, PR:L means any standard user account suffices, AC:L indicates no special timing or race conditions are needed, and S:C with full C:H/I:H/A:H means the attacker can achieve complete system compromise including potential hypervisor-layer impact via PowerVM VIOS. No EPSS data was provided in the intelligence feed, so exploitation probability cannot be quantified against population base rates; however, the technique class - environment variable injection - is well-understood, requires no memory corruption, and is achievable without sophisticated tooling. There is no CISA KEV listing and no known public exploit code, suggesting the vulnerability has not yet seen widespread active exploitation. The absence of elevated attack complexity combined with full scope change and complete impact triad makes this a higher real-world priority than many nominally higher-CVSS network-based vulnerabilities that require multi-step chaining - organizations running AIX production infrastructure should treat patching as urgent rather than routine. Note that EPSS absence is a data gap, not a low-risk signal.

A local user with a standard shell account sets the ODMDIR environment variable to point to an attacker-controlled directory, then invokes or waits for a privileged system utility that consults ODM configuration without sanitizing the path. The malicious directory contains crafted ODM objects that cause the utility to pass attacker-supplied strings as OS commands, yielding root or hypervisor-level command execution. No public proof-of-concept code has been identified, but the technique requires only AIX system knowledge and is straightforward to develop independently.