IBM AIX CVE-2026-17171

Exploitation requires a local user account on the affected IBM AIX 7.2/7.3 or PowerVM VIOS 4.1 system with the ability to create files or symlinks in a directory accessible to the vulnerable privileged operation. The CVSS PR:L metric confirms a non-privileged (standard) local account suffices - no administrative rights are required to initiate the attack. Exploitation is limited by the requirement for local system access (AV:L), meaning network-only attackers cannot exploit this directly; an attacker must first obtain a local shell through another vector (e.g., SSH with valid credentials, another local vulnerability, or physical access). The specific AIX subsystem or setuid binary performing the unsafe symlink resolution is not identified in available data - the exact triggering operation must be referenced in the IBM advisory. No special non-default configuration is described as a prerequisite.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates local exploitation requiring only a standard user account (PR:L) with low attack complexity (AC:L) and no user interaction. The C:H rating is notable - while the primary primitive is file overwrite (I:H), overwriting sensitive files such as /etc/passwd or SSH authorized_keys can yield confidentiality impact, justifying the high CIA triad. EPSS data was not provided in available intelligence; the absence of KEV listing and public POC reduces near-term automated exploitation risk, but the AC:L rating suggests that once a vulnerable operation is identified, exploitation is straightforward for a local attacker. The scope is unchanged (S:U), meaning the exploit does not jump security boundaries beyond the host OS - in a PowerVM VIOS context this is significant because VIOS compromise can affect guest LPAR availability. This is a genuine priority for environments where untrusted local users exist on AIX or VIOS hosts, but lower priority in tightly controlled environments with no interactive local accounts beyond administrators.

A local user with a standard shell account on an IBM AIX or VIOS host identifies a privileged daemon or setuid binary that writes to a predictable temporary path or user-influenced directory. The attacker removes or races that path and replaces it with a symlink pointing to /etc/cron.d/ or /etc/ssh/authorized_keys for root. When the privileged operation executes, it follows the symlink without validation and writes attacker-controlled content to the target, enabling subsequent privilege escalation or persistent access. No public exploit identified at time of analysis, but AC:L suggests the technique is straightforward once the vulnerable operation is identified.