IBM AIX CVE-2026-16946

Exploitation requires a valid local account on the affected IBM AIX 7.2/7.3 or PowerVM VIOS 4.1 system with at minimum low OS-level privileges (PR:L per CVSS). The attack vector is strictly local (AV:L), meaning remote unauthenticated exploitation is not possible without a prior foothold. No special non-default configuration is identified as required - the vulnerability appears to exist in a component present in standard AIX/VIOS installations. Limiting factors include: the need for interactive or programmatic local access (shell account, SSH session, or local console); the attack does not cross scope boundaries (S:U), so exploitation is confined to the compromised host. No user interaction from a privileged user is needed (UI:N).

The CVSS 7.8 High vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a high-severity local privilege escalation: reliably exploitable, requiring only a low-privileged shell account, with full impact across confidentiality, integrity, and availability. No EPSS score was provided in the source data, so probabilistic exploitation likelihood cannot be quantified. This CVE is not listed in the CISA KEV catalog and no public exploit code has been identified, which tempers urgency compared to a KEV-confirmed flaw. However, organizations relying on IBM AIX or PowerVM VIOS for critical workloads - financial transaction processing, ERP, mainframe-adjacent infrastructure - should treat this as a meaningful escalation risk, as any low-privileged insider or compromised service account could leverage it for full system takeover. The reliability implied by AC:L means that once local access is obtained, exploitation is not a significant technical barrier. A patch is available from IBM, so remediation is actionable immediately.

An attacker with a low-privileged local account on an IBM AIX 7.3 server - obtained through credential theft, a compromised application account, or insider access - triggers the heap buffer overflow in a vulnerable AIX system component, corrupting heap metadata or a function pointer to redirect execution. The attacker then achieves code execution in a higher-privileged context, escalating to root and obtaining full control of the system and any data it processes. No public exploit code has been identified at time of analysis, but the low complexity rating (AC:L) indicates the overflow is deterministically triggerable.