IBM AIX CVE-2026-16935

Exploitation requires an existing local account with at least low-privilege access (PR:L per CVSS) on the affected IBM AIX 7.2/7.3 or PowerVM VIOS 4.1 system - this cannot be exploited remotely (AV:L). The attacker must be able to run concurrent processes on the target system to create the race condition, so interactive shell or equivalent local code execution access is a prerequisite. High attack complexity (AC:H) means the attacker must win a specific timing window, and the SSVC 'Automatable: no' classification confirms this is not reliably scriptable. Exploitation is limited to AIX 7.2/7.3 and VIOS 4.1; other IBM operating systems or PowerVM versions are not listed as affected. The specific system component or configuration flag that exposes the vulnerable code path is not disclosed in available intelligence - the exact prerequisite feature or service should be confirmed with the IBM advisory at https://www.ibm.com/support/pages/node/7283858.

The overall real-world risk is moderate-to-low despite the CVSS 7.0 rating. The CVSS vector (AV:L/AC:H/PR:L) clearly scopes this to local, low-privileged attackers who must successfully time a race - a non-trivial requirement that is explicitly reflected in SSVC's 'Automatable: no' classification. EPSS of 0.12% (2nd percentile) strongly corroborates that exploitation is unlikely at scale and is consistent with SSVC 'Exploitation: none,' meaning no known active exploitation exists. The 'Technical Impact: total' from SSVC confirms that a successful exploit fully compromises the affected system, which aligns with C:H/I:H/A:H in the CVSS vector. This is a case where CVSS base score (7.0) and real-world risk diverge: the high attack complexity and requirement for local access substantially reduce operational exploitability compared to what the impact sub-scores alone might suggest. The low EPSS and zero KEV listing support treating this as a planned-patch-cycle priority rather than an emergency response item, unless the environment exposes AIX or VIOS systems to untrusted local users.

A low-privileged local user on an IBM AIX or PowerVM VIOS system repeatedly triggers an operation that involves a security check on a shared resource (e.g., a file or symlink), simultaneously substituting that resource between the check and its use by a privileged process. By winning the race condition timing, the attacker causes the privileged operation to act on attacker-controlled input, resulting in execution of arbitrary code or modification of system files with elevated (potentially root) privileges. No public proof-of-concept exploit code has been identified, and the high attack complexity means reliable exploitation requires careful timing and likely multiple attempts.