IBM AIX CVE-2026-17118

No special conditions per the CVSS vector - remote unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N) against affected versions of IBM AIX (7.2, 7.3) and PowerVM VIOS (4.1). The limiting factors are that the attacker must have network reachability to the specific vulnerable service on the host, and the target must be running one of the named affected versions; the description does not identify the exact affected service, protocol, or port, so defenders should confirm which listening service carries the flaw via the vendor advisory to scope network-level mitigations. Reliable exploitation also requires the attacker to successfully weaponize a use-after-free, which is nontrivial and no public POC currently exists.

The signals are strongly aligned toward high priority: the CVSS 3.1 base score is 9.8 with a fully remote, low-complexity, unauthenticated, no-interaction vector and total C/I/A impact, and the vulnerability was reported by the vendor (IBM) with a patch already available. Countervailing signals moderate the immediate urgency: there is no CISA KEV listing and no public proof-of-concept identified, and no EPSS score was provided in the input, so real-world exploitation probability cannot be quantified from the data given. Use-after-free bugs are exploitable but often require attacker skill to weaponize reliably, so the absence of a POC suggests exploitation is not yet trivial or widespread - however, given the maximal CVSS profile and that memory-corruption RCE in an enterprise OS network service is a high-value target, defenders should treat this as an urgent patch item rather than deferring on the basis of missing EPSS/KEV data. Because AIX and VIOS underpin production workloads in banking, telecom, and other continuity-sensitive environments, any operator running affected versions should schedule the fix promptly and verify exposure of the affected service to untrusted networks.

An attacker with network reachability to an affected AIX or VIOS host sends crafted traffic to the vulnerable network service, triggering the use-after-free to corrupt heap memory and hijack control flow, resulting in arbitrary code execution at the privilege level of the affected service - potentially root or the VIOS service account. No authentication or user interaction is required per the CVSS vector, so a single reachable, unpatched host is sufficient. No public exploit is identified at time of analysis, so an attacker would need to develop a working exploit for the use-after-free.