IBM AIX CVE-2026-16952

Exploitation requires an authenticated local user account on the affected IBM AIX 7.2/7.3 or PowerVM VIOS 4.1 system - confirmed by the CVSS vector PR:L (low-privilege authenticated access) and AV:L (local attack vector). The attacker must have the ability to execute processes or consume resources on the target system. No special configuration, feature enablement, or non-default deployment mode is specified in the description as a prerequisite. What limits exploitation: the attacker must already have local shell access; remote unauthenticated exploitation is not possible per the AV:L vector. The specific resource type being abused (CPU, memory, file descriptors, IPC) is not identified in available data, so it is unknown whether OS-level resource quotas (ulimits, WLM) in specific configurations would prevent exploitation.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) characterizes this as a local, low-complexity denial-of-service requiring only a standard user account - no special configuration or user interaction needed. The scope is unchanged (S:U), meaning impact is contained to the vulnerable component and does not cross privilege boundaries to affect other systems. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept has been identified, which meaningfully reduces near-term exploitation risk. While the CVSS availability impact is rated High, the local-only attack vector significantly narrows the attacker population to those with existing shell access - this is a meaningful constraint in well-managed AIX environments with strict account controls. In environments where shared AIX or VIOS partitions host multiple tenants or less-privileged service accounts, however, even a low-privileged user could weaponize this to disrupt I/O services for all dependent logical partitions, which elevates practical severity beyond the raw score suggests. The absence of confidentiality and integrity impact confirms this is purely a stability concern.

An attacker with a standard local user account on an IBM AIX or PowerVM VIOS system deliberately triggers resource consumption - for example, by spawning processes or allocating resources in a tight loop - until the system's resource pool is exhausted, causing services or the OS itself to become unresponsive. On a VIOS host, this could deny I/O services to all client logical partitions depending on that VIOS, amplifying the impact beyond the single host. No public proof-of-concept has been identified, but the attack concept is straightforward for any user with shell access.