IBM AIX CVE-2026-16996

Exploitation requires an attacker to have an existing local user account with interactive login access (shell access) on the affected AIX 7.2/7.3 or PowerVM VIOS 4.1 system - reflected in the CVSS PR:L metric. No network-facing exposure is required; the attack vector is strictly local (AV:L). No user interaction from a privileged user is required (UI:N), and attack complexity is low (AC:L), meaning no race conditions or special target state is needed beyond local access. The primary limiting factor is that the attacker must already have a foothold on the system - external unauthenticated attackers cannot exploit this directly. The scope change (S:C) suggests a specific execution context (likely a privileged system service or VIOS hypervisor interface) is reachable from a low-privilege account, but the exact triggering binary or subsystem is not identified in available data.

The CVSS 8.8 score is driven primarily by the S:C (Scope Changed) and full C:H/I:H/A:H triad, despite requiring local access (AV:L) with low privileges (PR:L). The scope change is the critical risk multiplier here - in a PowerVM VIOS deployment, successful exploitation could allow a compromised VIOS process to affect the hypervisor layer or co-located guest LPARs, amplifying the real-world blast radius well beyond a single system. No EPSS score was provided, and the vulnerability is not listed in CISA KEV, meaning active exploitation has not been confirmed by any intelligence source at time of analysis. No public proof-of-concept has been identified, which reduces immediate opportunistic risk. However, the low attack complexity (AC:L) and absence of required user interaction (UI:N) mean that once a threat actor has local access, exploitation is not technically demanding. Organizations running AIX or PowerVM VIOS in multi-tenant or shared LPAR environments should treat this as a high priority, as the scope-change dynamic means lateral movement to other hosted workloads is a plausible consequence. Patch availability mitigates the window of exposure for organizations with rapid patching cycles.

A low-privileged local user with shell access to an IBM AIX or PowerVM VIOS system triggers a vulnerable code path by invoking a system utility or service that performs an integer arithmetic operation susceptible to underflow, causing an out-of-bounds memory write. The attacker leverages this memory corruption to overwrite control-flow data (e.g., a function pointer or return address), redirecting execution to attacker-controlled code running at elevated privilege. In a PowerVM VIOS context, this could allow the attacker to affect resources shared with other LPARs hosted on the same physical POWER server. No public proof-of-concept has been identified, meaning this scenario currently requires meaningful exploit development effort.