IBM AIX CVE-2026-17141

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions - remote unauthenticated exploitation with no user interaction against IBM AIX 7.2/7.3 or PowerVM VIOS 4.1. The description does not name a required feature, protocol, or non-default configuration, so the vulnerable network service is assumed reachable in affected default deployments; this cannot be narrowed further from the available data. Practical limiting factors: the attacker must have network access to the specific (undisclosed) vulnerable service port, and AIX/VIOS are predominantly deployed on internal/management networks rather than the public internet, which constrains realistic reach; exploitation is also bounded to the listed versions (AIX 7.2, 7.3; VIOS 4.1).

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) describes a worst-case profile: network-reachable, low complexity, no privileges, no user interaction, with full CIA impact - the kind of pre-auth RCE that warrants urgent patching where the product is exposed. Countervailing signals temper the raw score: there is no EPSS value provided, the CVE is not in CISA KEV (no confirmed active exploitation), and no public POC is identified, so this is currently a high-severity-but-unproven-exploitation issue rather than a demonstrably weaponized one. An SSVC assessment cannot be completed because exploitation status, automatability, and technical-impact inputs beyond CVSS are not supplied. Note also that AIX/VIOS are typically deployed on internal enterprise networks rather than internet-facing, which materially reduces real-world reachability versus what AV:N alone implies - verify network exposure of management/service ports before ranking. The single sparse IBM description offers no detail on the affected service, so the AC:L assessment for a buffer overflow should be treated as vendor-assigned rather than independently corroborated.

An attacker with network reachability to an exposed AIX or VIOS service sends a crafted request whose oversized/malformed payload overflows a fixed-size buffer, writing past its bounds and corrupting memory to hijack control flow. Because no authentication or user interaction is required (PR:N/UI:N), a single successful request could execute arbitrary code with the privileges of the vulnerable service, potentially the system's most privileged context. No public POC is identified at time of analysis, so this scenario is inferred from the CVSS vector and CWE-787 class rather than a demonstrated exploit.