IBM AIX CVE-2026-17122

Exploitation requires network reachability to the specific vulnerable listening service on an affected host - IBM AIX 7.2/7.3 or PowerVM VIOS 4.1. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no privileges, and no user interaction are needed against a vulnerable configuration, so this behaves as unauthenticated remote exploitation. The practical limiting factors are: the target must be running one of the exact affected versions, and the vulnerable service must be reachable from the attacker's network position - AIX/VIOS deployments commonly sit behind management-network segmentation, which is the primary real-world constraint on reachability. The precise service/port that must be exposed is not identified in the provided data and should be confirmed from the IBM advisory.

The signals available point to genuine high priority rather than an inflated CVSS score. The CVSS:3.1 base of 9.8 reflects a network attack vector, low complexity, no privileges, and no user interaction, with High impact to confidentiality, integrity, and availability - the textbook profile of a wormable pre-auth RCE. No EPSS score is supplied in the input, and there is no CISA KEV listing and no known public POC, so exploitation is not confirmed in the wild; the risk here is potential rather than demonstrated. The main uncertainty is exposure scope: AIX/VIOS systems are typically deployed inside datacenter management networks rather than on the public internet, so real-world reachability often depends on network segmentation, which can substantially reduce practical risk versus the raw 9.8. Even a mid-sized operator running Power estates should treat an unauthenticated RCE in the VIOS/AIX stack as urgent, because compromise of VIOS can cascade to every hosted LPAR. Net assessment: patch promptly; the absence of a POC lowers immediate mass-exploitation likelihood but does not lower the intrinsic severity.

An attacker with network access to an exposed AIX or VIOS service sends a crafted request containing an oversized field that overflows a stack buffer in the handling code, overwriting the return address and redirecting execution into attacker-supplied shellcode. Because no authentication or user interaction is required, a single unauthenticated packet flow to the vulnerable listener could yield code execution on the host; no public POC is known at time of analysis, so exploitation would currently require original vulnerability research.