IBM AIX CVE-2026-16980

Exploitation requires an authenticated local user account on the affected system (CVSS PR:L confirmed). The attacker must also win a race condition between the vulnerable component's path validation and file open steps (CVSS AC:H), which implies a timing-dependent prerequisite that prevents reliable automated exploitation at scale. No non-default configuration or special feature flag is described as a prerequisite in the vendor description - the vulnerability appears to exist in standard AIX/VIOS functionality. Exploitation is limited to users with interactive shell access or the ability to execute code locally on the system; remote unauthenticated exploitation is not possible given AV:L.

The CVSS 6.3 Medium score is shaped primarily by two mitigating metrics: AV:L (local access only) and AC:H (high attack complexity), which together substantially reduce the exploitable population compared to network-facing vulnerabilities. The AC:H rating is consistent with a race condition requiring precise timing, limiting reliable exploitation. With PR:L, any authenticated local user is a potential threat actor, but the complexity barrier makes automated or opportunistic exploitation unlikely. No EPSS data was provided, no proof-of-concept code is publicly available, and the CVE does not appear in the CISA KEV catalog - all consistent with a low active-exploitation signal. Notably, the CVSS vector records I:H alongside A:H, which is atypical for a pure denial-of-service primitive and suggests the symlink redirection may enable writes to sensitive file paths, causing integrity damage beyond simple service disruption. The 'Denial Of Service' tag in the input may therefore understate the full impact. IBM Power systems typically host mission-critical workloads, so even the local-only, medium-severity rating warrants prompt patching within normal patch-cycle SLAs rather than emergency response. CVSS and EUVD data are aligned; no conflicts were detected across sources.

A local authenticated user on an IBM AIX or PowerVM VIOS system creates a symbolic link in a world-writable directory pointing to a sensitive system file. The attacker then races a privileged system component's file resolution operation - replacing a regular file with the symlink in the window between path check and file open (TOCTOU) - causing the component to operate on the attacker-chosen target, resulting in file corruption or service crash. No public proof-of-concept code has been identified; this scenario is inferred from the CWE-59 class and CVSS AC:H metric.