IBM AIX CVE-2026-17159

No special conditions are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U): remote unauthenticated exploitation against default network-accessible configurations of IBM AIX 7.2, 7.3, or PowerVM VIOS 4.1. The specific network-facing service or protocol that processes the malformed input is not identified in the available data, which limits defenders' ability to surgically disable or restrict only the vulnerable component. What limits exploitation is physical or logical network segmentation - systems not reachable from untrusted networks are not directly exposed. PowerVM VIOS 4.1 systems are particularly impactful targets because a successful DoS against VIOS cascades to all guest logical partitions dependent on that VIOS instance for I/O.

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) places this firmly in the High severity band, and the attack surface is maximally exposed: network-reachable, unauthenticated, low complexity. The sole impact is availability, meaning this is a pure DoS - no confidentiality or integrity risk is present. For IBM Power environments - particularly those running PowerVM VIOS, where the VIOS partition is the I/O gateway for all guest workloads - a crash of the VIOS would cascade to all dependent logical partitions, amplifying business impact beyond a single-system outage. No EPSS score was provided, and the vulnerability is not listed in CISA KEV, indicating no confirmed or widely observed active exploitation. No POC code has been identified. The practical priority for operators depends heavily on network exposure: AIX/VIOS systems behind strict perimeter controls with no direct internet exposure face substantially lower immediate risk than those reachable from broader networks. The absence of KEV listing and POC reduces urgency compared to a typical AV:N/PR:N flaw, but the impact on virtualization infrastructure elevates relative business risk for IBM Power shops.

A remote attacker with network access to an IBM AIX 7.2/7.3 or PowerVM VIOS 4.1 system sends a crafted network packet or request that triggers an integer overflow in a network-reachable handler, causing the vulnerable process or kernel component to crash and rendering the system - or in the VIOS case, all dependent guest partitions - unavailable. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) and absence of authentication requirements (PR:N) mean a working exploit would be straightforward to develop by an attacker with knowledge of the vulnerable code path.