IBM AIX CVE-2026-17422

Exploitation requires an authenticated local session on the vulnerable IBM AIX or VIOS system with at least low-privileged OS-level access (CVSS PR:L), consistent with a standard non-root shell account. No user interaction is required (UI:N) and the attack complexity is low (AC:L), meaning no race condition or environmental dependency must be overcome beyond obtaining local access. The CVSS scope change (S:C) implies the vulnerable component is distinct from the impacted resource - in VIOS this likely means a low-privileged process or guest partition interface that interacts with a higher-privileged VIOS subsystem. Exploitation is not automatable per SSVC (Automatable: no), ruling out worm-like mass compromise. The primary limiting factor is the requirement for prior authenticated local access to the target system, which excludes unauthenticated remote attackers but does not require administrative credentials.

The CVSS base score of 8.8 reflects the severity of a fully weaponizable local privilege escalation with changed scope and total impact (C:H/I:H/A:H), but several signals temper the urgency for most organizations. EPSS at 0.18% (8th percentile) indicates very low current exploitation probability relative to the broader CVE population, and SSVC confirms exploitation status as none with no automatable path - meaning mass exploitation is not feasible, and each attack requires individualized local access. KEV status is absent, with no CISA confirmation of active exploitation. Nevertheless, SSVC rates technical impact as total, meaning successful exploitation is catastrophic in scope, particularly in VIOS environments where cross-LPAR impact could affect multiple guest workloads from a single compromised low-privileged account. The local attack vector limits internet-exposed risk, but IBM Power Systems are frequently deployed in high-value financial services and critical infrastructure contexts - environments where even a mid-sized enterprise IBM Power shop must treat local-privilege-to-hypervisor paths as high priority regardless of raw EPSS scores. The primary risk driver is the VIOS scope change: this is not a simple local escalation within one OS instance but a potential hypervisor boundary crossing.

A low-privileged local user on an IBM AIX 7.2/7.3 or PowerVM VIOS 4.1 system crafts input that triggers an out-of-bounds write in a vulnerable system component, corrupting memory structures to redirect execution flow to attacker-controlled code. In a VIOS context, the attacker - potentially an authorized but unprivileged operator of a guest LPAR - escalates to full control of the VIOS partition, from which they can manipulate I/O for all hosted LPARs or exfiltrate data across partition boundaries. No public proof-of-concept has been identified at time of analysis, but the low attack complexity (AC:L) means exploitation is straightforward once the vulnerable code path is identified.