IBM AIX CVE-2026-18824

Exploitation requires a valid account with low-level system privileges on IBM AIX 7.2/7.3 or PowerVM VIOS 4.1, as indicated by CVSS PR:L. The attacker must have network-level reachability to the vulnerable service (AV:N, AC:L). No user interaction is required once credentials and network access are established. Exploitation is not automatable at scale per SSVC assessment, indicating the vulnerable endpoint likely requires non-trivial request construction or session establishment rather than a blind unauthenticated probe. The specific vulnerable service or binary is not identified in publicly available data, which limits the precision of access restriction workarounds. Systems not running AIX 7.2, AIX 7.3, or VIOS 4.1 are not confirmed affected by available data.

The CVSS 8.8 base score reflects a network-reachable attack path (AV:N), low complexity (AC:L), and full C/I/A impact - a combination that is severe in any enterprise context. The PR:L requirement provides a meaningful but low barrier: any valid low-privilege account suffices, making credential hygiene and account hardening the primary compensating factor. The EPSS score of 0.66% at the 49th percentile indicates that real-world exploitation probability sits below median for network CVEs, and the SSVC framework corroborates this with Exploitation status of 'none' and Automatable set to 'no', suggesting the flaw cannot be trivially mass-exploited. However, the SSVC Technical Impact of 'total' means that once an attacker clears the credential barrier, the outcome is full system control - even a mid-sized industrial or government deployment in bytom should treat this as urgent remediation, particularly given that a VIOS compromise cascades to all hosted LPARs on the Power chassis. The absence of KEV listing and confirmed POC keeps the immediate threat tier below what the CVSS score alone implies, but the high-value nature of AIX/VIOS targets in critical sectors warrants prioritized patching.

An attacker who has obtained low-privilege credentials - via phishing, credential reuse, or insider access - sends a crafted network request to the vulnerable IBM AIX or VIOS service, embedding shell metacharacters in a parameter that is passed unsanitized to an OS command. The injected payload executes with the privileges of the service process, granting the attacker read, write, and code execution access to the Power system host; on a VIOS target, this compromise can extend to all LPARs sharing virtual storage and networking through that VIOS instance. No public exploit code has been identified at time of analysis.