IBM AIX CVE-2026-16944

Exploitation requires a local interactive session or equivalent code execution context on the affected IBM AIX 7.2/7.3 or PowerVM VIOS 4.1 system, with at minimum a low-privileged user account (PR:L per CVSS:3.1/AV:L). No network-based or remote unauthenticated exploitation path is indicated; the local attack vector (AV:L) means the attacker must already have local access. The specific vulnerable component or binary within AIX or VIOS is not named in available data, so the precise triggering mechanism is not confirmed. Exploitation is not automatable per SSVC, and no special non-default configuration is identified as a prerequisite beyond having a valid local account.

The CVSS 7.8 score reflects genuinely high post-exploitation impact - full CIA triad compromise - but the local attack vector (AV:L) and low-privilege requirement (PR:L) are meaningful constraints that significantly limit the attack surface. EPSS at 0.17% (7th percentile) is very low, indicating negligible observed exploitation activity in the wild, which aligns with the SSVC determination of exploitation: none and automatable: no. The combination of a local-only vector with no remote exploitability means mass automated exploitation is not a realistic threat. However, SSVC's technical impact rating of 'total' confirms that a successful exploit yields complete system compromise, making this a serious priority for environments where IBM AIX or PowerVM VIOS hosts sensitive workloads or LPAR infrastructure. The absence of a KEV listing and the low EPSS suggest this is not being actively targeted, but the CVSS and SSVC signals together indicate that any insider threat or post-initial-access scenario on IBM Power Systems infrastructure warrants prompt patching.

A local user with a low-privileged account on an IBM AIX or PowerVM VIOS system invokes a vulnerable binary or triggers a code path that processes attacker-controlled input into a fixed-size stack buffer. The overflow corrupts the stack frame, redirecting execution to attacker-supplied code and resulting in arbitrary code execution, likely escalating to root-level privileges. No public exploit code has been identified at time of analysis.