IBM AIX CVE-2026-16958

Exploitation requires network-level connectivity to a service or protocol handler running on IBM AIX 7.2 or 7.3, or IBM PowerVM VIOS 4.1. The CVSS vector (PR:N, UI:N, AC:L) indicates no authentication and no user interaction are required, and complexity is rated low. However, the SSVC 'Automatable: no' designation suggests that reliable exploitation may depend on specific input sequencing or protocol state, limiting mass-automated scanning-style attacks. The specific network service or port implicated is not disclosed in available data, which limits defender ability to apply targeted service-level controls without vendor guidance. Exploitation is constrained to denial of service only - no confidentiality or integrity impact applies. Systems not directly reachable from untrusted networks (air-gapped, VPN-only, or behind strict perimeter controls) face significantly reduced risk.

CVSS 7.5 High with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H signals unauthenticated, low-complexity network exploitation with full availability impact - a serious DoS posture on paper. However, several signals temper the urgency: EPSS stands at 0.31% (23rd percentile), placing this well below the threshold of actively targeted vulnerabilities; SSVC assessment rates exploitation as 'none' and the vulnerability as not automatable, suggesting that reliable end-to-end exploitation may require specific packet sequences or conditions not captured in the CVSS access-complexity metric alone. Technical impact is rated 'partial' by SSVC, consistent with the DoS-only scope. There is no CISA KEV listing and no known public exploit code. The SSVC 'Automatable: no' finding is notable tension against CVSS AC:L - this may indicate that while network access is sufficient, triggering the write reliably requires crafted or stateful input rather than a simple one-packet trigger. IBM and VIOS environments typically operate in secured data-center and cloud infrastructure contexts, which may further limit opportunistic exposure. Patch is available from IBM; priority should be treated as high for internet-facing or multi-tenant VIOS deployments but routine for air-gapped or well-segmented environments.

A remote unauthenticated attacker sends a specially crafted network request to a vulnerable AIX 7.x or PowerVM VIOS 4.1 system, triggering an out-of-bounds write in a network-facing service handler. The memory corruption destabilizes the affected process or kernel subsystem, causing a system crash or hang and denying service to all workloads hosted on or routed through the affected system. No public exploit code has been identified at time of analysis, but the network-reachable, unauthenticated nature of the vulnerability means a working exploit would require only connectivity to the target.